The first category (which happens to be the one that Phil Corwin wants to exclude from disclosure requirements, but that’s a different thread) requires looking at the domain name itself.  The second category requires looking at the resource (such as but not necessarily limited to a website) associated with the domain name.  Websites engaged in counterfeiting and piracy fall in the second category; so do websites used for distribution of malware.  If you wish, you can call one of these content and the other something else, but they share the important characteristic that they require looking beyond the domain name to see the abuse.