; or (D) (i) the query uses a known cybersecurity threat signature as a query term; (ii) the query is conducted, and the results of the query are used, for the sole purpose of identifying targeted recipients of malicious software and preventing or mitigating harm from such malicious software; (iii) no additional contents of communications retrieved as a result of the query are accessed or reviewed