Bagle seems to simply grab everything up to and not including the second '.' Right-to-Left. I doubt they took subdomains into consideration... Im sure that now that you mentioned it here, this will be fixed in the next revision (I wonder if they file bugs with themselves?)