I don't really understand why the filter syntax works the way it does, it's especially weird for cloaking purposes. [a-z0-9]*.example.com doesn't match every possible character in a subdomain. Usually when you do *.example.com, example.com isn't matched, you can't exclude =example.com from a cloak, while still wildcarding the subdomains.