1 article on security alerts.
Track domain reputation over time: distinguish a new phishing report from expected DNS changes, then decide what to verify before restricting access.
