The privacy filter expands to catch edge cases like bare [provider domain] without TLD prefix and gmx with trailing slash after specific incidents demonstrated the need for longest-first matching against all domain variants.