Malware is Malware… except when it isn’t
So block anomalous activity first and ask questions later (please).
As IT professionals (and logical human beings) we have been taught to analyze a situation first and then act based on knowledge gained from the analysis. Acting without an understanding of the full picture is considered impulsive and oftentimes, even foolish.