Any online action that poses risk to systems or users.
A client under spoofing attack refuses to enforce DMARC despite clear phishing evidence.