A domain registered through a registrar with high abuse-rate history and known association with mass-abuse campaigns.
“Decline. Low-trust registrars are over-represented in attack infrastructure baselines. Treat as hostile until the asset proves otherwise.”