One Customer Domain Is Confirmed Phishing. Should the Rest Be Reviewed?

ICANN is considering Associated Domain Checks when a registrar has actionable DNS abuse evidence on one domain.

For a host or reseller, imagine a customer with dozens of domains and one confirmed phishing name. Checking the rest may uncover a larger campaign, but a compromised site can also be an isolated incident.

Would “review the account, but require separate evidence before action on each domain” be a fair operational rule?