Good and Bad News!
First, the bad news is that the trailing asterisk in .ru/B* did not help.
In the above two rules, each of the 13 caught by Russia was
also caught by Russia B. Each of the 12 missed was missed by
Good news is, after closely analyzing the hex in what was caught and missed, I think I finally figured it out.
The catch is when there are 2 CRLF adjoining the .ru: www.somewhere.ruCRLFCRLF next line may be blank or may have text CRLF (or sometimes no next line at all)
The miss is when it is followed by only 1 CRLF: www.somewhere.ruCRLF (next line is blank in the ones I looked at) CRLF
So, it appears the bug is not at EOM, but at the end of a line.