Domains caught matching a threat-actor watchlist (by infrastructure or identity). Internal analyst view.