___Co-Occurrence___ allows you to find requests that happen often at the same time as the selected domain. Hence, it will give you a hint what apps might be involved in the activity.

How do you interpret these results? Lets look at an example:

<IMG>

The domain __example.org__ has __14__ requests with an _average time divergence_ of __0.71 seconds__. That is, these 14 domain calls happend, on average, less then a second before or after the original request of the selected domain.

Close temporal proximity and high occurrence counts are both indicators for domain correlation. Results are sorted by a ranking index (__9.__) which strikes a balance between the two. Preferring entries with higher counts as well as low time divergence.

_Tip:_ As a visual guide, you can look for the colored bar beside each value. The larger the bar, the greater the correlation.