Re: regexp body_check help - IP address

Matt Fretwell wrote:

> Jim Wright wrote:
>
> > href="http://198.31.130.18/.signin.ebay.com/cgi4.ebay.com/ws3/
> > eBayISAPI.dll/signin/"
> >
> > That was courtesy the latest phish... So, I came up with a regexp
> > that
> >
> > would match from the equal sign through the first slash after the IP
> > address, and put it in my body_checks file as follows:
> >
> > /=\"http:\/\/(([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0
> >
> > -5])\.([01]?\d\d?|2[0-4]\d|25[0-5])\.([01]?\d\d?|2[0-4]\d|25[0-5]))\//
> >
> > Reject ALERT
>
> Are you just wishing to match the http://ip.add.ress/?


Responding to my own post. How sad :)
If you are just wanting to catch '="http://ip.address/' try:

/="?http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\//

Non capturing pcre pattern.

Matt