@guypod walmart case is covered by above query, the other three would indeed come out as third-party false positives. That said, based on inspecting the first couple thousand classifications, I think you’re overestimating the prevalence of such domains.
