Maybe the domains "drybook.info" and "rootface.info" were already on the list. It's possible that a previous domain holder used those domains as part of a spam run.