Victim list

Networks (ISP) most frequently represented in phishing incidents stored in D1 (phishing_links): count of rows, average score, and max score (same fields as the ingestion schema).