Interesting my cases supposedly came from some .edu or other educational related TLDs at first then it devolved into randoms... Well I will need to monitor and maybe do my own rules as well.