Which addresses are considered “ambiguous addresses” and are put on the greylist by the Cisco ASA botnet traffic filter feature?

Which addresses are considered “ambiguous addresses” and are put on the greylist by the Cisco ASA botnet traffic filter feature?
A. addresses that are unknown
B. addresses that are on the greylist identified by the dynamic database
C. addresses that are blacklisted by the dynamic database but also are identified by the static whitelist
D. addresses that are associated with multiple domain names, but not all of these domain names are on the blacklist