Just to state the obvious, .gov, .edu, and .mil are all restricted TLDs run by the US. What kind of attacker uses domain names in their attack that they can't register?

Unless, of course...

But that would be a wee bit obvious.