An endpoint is classified as "malicious" if the traffic is observed destined toward a well-understood attack victim.