1 article on dns.
Track domain reputation over time: distinguish a new phishing report from expected DNS changes, then decide what to verify before restricting access.