I'm still finding some numeric ip addresses in the blocked sites reports. Can't NSM do a reverse dns lookup to see if the domain that owns the site is allowed or not?
I've hit this with a few different sites where they have hard coded ip addresses on their site that cause problems. If I've added the domain (for example learning.drexel.edu) then the numeric version, 144.118.31.45, should not be blocked.