I also incidentally found an easy a filter for these. I found once that our proxy auto config has 10 misspelled domain names. Those are all used for the Phishing Tests.