This relies on Module 2’s baseline to make signs stand out and feeds Module 4’s risk scoring (a flag becomes a scored risk) and Module 5’s response (a confirmed bad domain gets blocked or sinkholed). It stays strictly defensive throughout.