| |uri SpoofPort_URL /.*\....:.*|.*\...:.*/ score SpoofPort_URL 1 | Ok MK2 that one could FP on genuine URLs with a port specified
uri SpoofPort_URL /.*\....:.*|.*\...:.*/ score SpoofPort_URL 1 uri OkPort_URL /.*\....:....|.*\...:...../|/.*\....:....\/.*|.*\...:.....\/.*/ score OkPort_URL -1 Sorry for so many posts, this is a learning curve for me, sure this can be done better possibly with a meta rule but that's getting way too much above me for now. This will do till someone comes up with a better rule or fix.
