Reminds me of when I was in school, and you could access blocked sites by appending a dot. Presumably their firewall had a bunch of domain block rules that didn’t take this into account, and the vendor didn’t think to check for both variations of a domain.