Prioritise IOCs: “domain registered 3 days ago, tagged phishing → escalate”
Remove junk traffic and fake sign‑ups by scoring domains at ingest.
Strip parked or disposable domains, analyse mailbox‑provider mix, boost inbox rates.