During an investigation, an analyst notices that a little-known domain is queried by the same clients within moments of queries to domains already confirmed as part of a phishing campaign. Which Investigate indicator captures this relationship?
Select an answer to reveal the explanation.
Short Explanation
If two people keep showing up at the same place at the same minute, you start to think they came together. Co-occurrence is that idea for DNS: domains looked up right alongside each other are probably part of the same chain. Don't mix it up with WHOIS, which is about who registered a domain, not when it gets queried.
Full Explanation
Co-occurrences in Investigate list domains that are queried by the same clients within a short window around queries for the domain being examined. Because a single phishing page or exploit chain typically causes a browser to resolve several attacker-controlled names in sequence, such as a landing page, a redirector and a payload host, a domain that consistently co-occurs with confirmed campaign domains is very likely part of that campaign. That is exactly the relationship described: the same clients querying the unknown domain moments after the known bad ones. WHOIS data links domains by registration details such as registrant email or name server, which is a valuable pivot but measures ownership rather than query timing. Popularity reflects how widely a domain is queried overall; it says nothing about which other domains are queried with it. Content category describes the kind of material a site hosts and does not express a relationship between domains. Exam caveat: co-occurrence can also surface benign companions, such as common content delivery or analytics domains, so it must be weighed with risk and other indicators. Operational check: open the domain's co-occurrence list, confirm that the known campaign domains appear with strong scores, and block related domains that also carry poor security indicators.