Thorough write-up. One quick check that would sort your 16 candidates: registration date. Freshly registered names are more likely attacker-owned, while older sites are more likely compromised and used as relays. That also changes who you report to: the registrar for the first, the site owner for the second.

WHOIS gives you creation dates for most of them. For a list this size, the WhoisFreaks WHOIS API does RDAP and port 43 behind one JSON, with 500 free credits (disclosure: I work there).