If they were displayed in the opposite (big-endian) order, the 3rd example above would become: http://xx.baz.com|bar.foo Notice how the "com" and "foo" are now separated.
http://xx.baz.com|bar.foo
The "real" (unspoofed) URI would look like this: http://com.foo
Erik