Use IETF RFC 9162, Certificate Transparency Version 2.0. Research the normative object structures and client roles before answering. A logged certificate is observable issuance evidence, not proof that its domain is malicious.