Your point about "unknown" outcomes and clear reason codes is fair. A score with no explanation is hard to dispute. One format that helps is when each flagged domain comes with its evidence: a confidence value, first and last seen dates, and how many infrastructure links tied it to a known threat. The WhoisFreaks feed schema (https//whoisfreaks.com/documentation/threat-intelligence-feed) is built that way, so a user can see why a domain was listed rather than only a number.