domains with -'s in the like www.malicious-site.com get split down to just 'site.com' which can result in benign sites being pulled as IOCs.