if it's happening server side they might have had a bug where they are doing naive substring comparison instead of actual domain evaluation