Expression writing to block across certain subdomains only

[bmard]

Hi, I've got multiple examples of paths or file types I want to block across a mix of main domain and subdomains. For example, I want to block .php completely on the main domain and two subdomains, but allow them on several more. Tried something like this:

(http.request.uri.path contains ".php" and ((http.host eq "primary domain") or (http.host eq "www.primary domain") or (http.host eq "subdomain"))

Results in a "not a valid value for expression because the expression is invalid: Filter parsing error (1:149): (http.request.uri.path contains ".php" and ((http.host eq "primary domain") or (http.host eq "www.primary domain") or (http.host eq "subdomain")) ^ expected literal ")" (Code: 20127) 

Any samples of the approach above that would work? I have been reviewing operators ruleset engine, and 
saw:

(http.host matches "^(www|store|blog)\.example.com" and http.request.uri.path contains ".php")...but how would I work 'primary domain' in there as also a hostname to execute on?

Thanks!

[bmard]

http.host matches "^(www|subdomain)\.maindomain" and http.request.uri.path contains ".php"

is working, minus for the naked maindomain. How would I go about working the maindomain into the above expression?