I managed to write a metarule for anyone interested, to catch a URL with trailing : without a port specified, without FP on a 4 digit port.
uri __SpoofPort_URL /.*\....:.*|.*\...:.*/ uri __OkPort_URL /.*\....:[0-9]....|.*\....:[0-9].+\/.*|.*\...:[0-9]....|.*\...:[0-9].+\/.*/ meta Spoof_Port_URL (( __SpoofPort_URL - __OkPort_URL) > 0) score Spoof_Port_URL 5 describe Spoof_Port_URL URL with trailing : but no port specified Martin
