So,
this MS report, one of @quartata's autoflagged FP, has two reasons that triggered. However, the two reasons are detecting "mockplus" and "mockplus.com". That appears inappropriate, because it effectively gives inclusion of a URL containing "mockplus.com" double weight. I haven't looked at the actual regexes, but it feels inappropriate to have two different rules, one which is a superset of the other.