Or they could just do it to regions/ips which are more suspicious.