Connections to known malicious domains or suspicious IP addresses (often hosted on Russia-based or bulletproof hosting providers).