Three domains used in a recent malware campaign all list the same registrant email address in their registration data. The analyst wants to find other domains the attacker may have prepared but not used yet. Which Investigate pivot is most useful?

WHOIS data records registration details such as registrant email, name, organization, registrar and name servers. Investigate lets an analyst pivot on those attributes, for example listing every domain registered with a given email address. Attackers who register infrastructure in bulk often reuse the same contact details, so a shared registrant email across known campaign domains is a strong lead to sibling domains, including ones registered in advance and not yet active. Blocking those proactively disrupts later stages of the campaign. Co-occurrences are derived from actual query traffic, so they reveal domains resolved together; a domain that has not been used yet has no query history to co-occur, and co-occurrence never claims to list everything an attacker owns. Popularity ranks how widely the known domains are queried, which helps judge impact but does not discover new infrastructure. Blocking by content category would affect many unrelated legitimate sites and does not target the attacker. Exam caveat: privacy-protected registrations hide registrant details, so WHOIS pivots work only when the attacker used real or reused data. Operational check: run the registrant-email pivot, review the returned domains' risk scores and registration dates, and add the suspicious ones to a block destination list.