Thinking that filtering hostname by regular expression "larslofgren\.com" would protect the account is a very common newbie mistake. It would still allow requests from e.g. larslofgren.com.example.com. The correct regular expression to match the domain would be "^(www\.)?larslofgren\.com$". To match other subdomains, "^(\w+\.)*larslofgren\.com$" can be used. Or, you can use other filters with options that require "exact match" or "ends with". (Sorry if those terms are not correct or accurate, I'm not using Google Analytics in English.)