Which of the following can be identified by correlating DNS intelligence and other security events? (Choose two.)