When a network intel provider’s domain serves fraudulent content, something is wrong