Right, though the IP may be serving multiple domains. I omitted this due to the added complexity and aim to keep the post focused on a simple assertion: security != privacy.