Re: regexp body_check help - IP address

Jim Wright wrote:

> href="http://198.31.130.18/.signin.ebay.com/cgi4.ebay.com/ws3/
> eBayISAPI.dll/signin/"
>
> That was courtesy the latest phish... So, I came up with a regexp that
>
> would match from the equal sign through the first slash after the IP
> address, and put it in my body_checks file as follows:
>
> /=\"http:\/\/(([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0
> -5])\.([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5]))\//
> Reject ALERT

Are you just wishing to match the http://ip.add.ress/?


Matt