Probably e-mail addresses are known.
There are methods to get a full list of all domains belonging to a server and/or nameserver so that might be an option. Mostly an info or contact mail address always works.
If it are different non info or contact mail addresses, then it might be something else. Be aware to check with Maldetect just to be sure too.