Hi Ido,
That isn't really practical as the URLs being requested are fairly random but all contain the http keyword or some other keywords we would never use. I had generated an irule that seemed to do the trick but was looking at using ASM to implement instead. The irule I used was in conjunction with a string datagroup.
when HTTP_REQUEST {
set uriclass "MalURI[URI::basename [virtual name]]"
Check that URI is sanitised
set luri [string tolower [HTTP::uri]]
if { [class match $luri contains $uriclass] }
{ HTTP::respond 200 content "Company Name\Naughty Naughty"
log local0. "URI is $luri"
}
}