What about misspelled domains? DNS Hijacking or Bit Errors? Hostile redirects from innocuous hacked domains? I'm not against using access as evidence, but there needs to be more context than a single attempt to access a domain.