Who is behind it?
Where a domain was registered, by whom and through which registrar, with the abuse contact and expiry date, and how that record has changed over time. For an address, the network it sits in, who owns that network, how recently the range was allocated, where it is in the world, and what its reverse DNS name says about it. Freshly allocated space at a bulk host with a throwaway name reads very differently from a long-established enterprise netblock.
What is it doing right now?
What the domain resolves to today and what it resolved to before, kept as passive DNS history. The certificates it has been issued, how new the latest one is, and which other names share them. What the server actually returns when asked: status, final destination, content type, page title and the certificate it presents. Shortened and redirecting links are followed to the end, and a change of host along the way is treated as a warning sign.
Who else is involved?
Every source that reported it and how much each one is trusted. The threat type it belongs to, from more than twenty the platform recognizes, with malware family, command-and-control status, and links to named campaigns and actors where a source provides them, so targeted infrastructure stands out from commodity crimeware. MITRE ATT&CK techniques are attached and can be exported as a Navigator layer.
What does it keep company with?
Other indicators in the same network range, on the same certificate or nameserver, reached by the same redirect, or resolving to the same address, mapped two hops out with a count of how many neighbours are themselves malicious. Alongside that, whether the domain is one of the internet's most popular, which caps its score, and whether your own team has marked it benign on a warning list.