[Gormo]

> The target variable is user hosted content on subdomains of a domain not listed in Mozilla's public suffix list.

No, that's the indicator. The target variable is "malicious website".