$re = '/((((\d{1,3}\.){2}\d{1,3})\[\.\])(\d{1,3}))\,(\d{1,5})?\/?(\d{1,5})?/';
$str = '185.106.121[.]118,
133.100.202[.]85,443
185.106.121[.]66,
82.211.30[.]195,
95.183.53[.]36,
84.200.17[.]144,
107.161.178[.]46,53/443
190.117.186[.]171,443
109.230.199[.]54,
87.98.179[.]18,57421
76.9.60[.]204,
125.214.195[.]17,
131.72.139[.]118,
196.29.166[.]218,
37.228.151[.]133,
37.10.71[.]99,
202.145.16[.]4,
133.94.1[.]3,
163.22.20[.]4,
210.135.90[.]41,
139.18.13[.]2,
212.19.128[.]4,
134.19.176[.]150,7777
185.101.34[.]122,6478
185.101.34[.]74,5367
185.25.51[.]246,
46.100.250[.]10,
62.201.235[.]227,
67.65.229[.]53,
188.165.149[.]249,
208.92.93[.]212,
209.239.123[.]75,
137.175.19[.]153,37779
http://doladolaladont[.]com,
https://alphanoun[.]bit/forum/ajax.php,
http://coffeol[.]com/fend/raw_server.exe,
http://inpend-traij[.]net/aka.doc,
http://twlnco[.]com/gskf/online.php,
https://a.pomf[.]cat/wryvpl.exe,
https://filesblog[.]bit/blog/ajax.php,
http://egonbute.duckdns[.]org,5588
http://kampolento.ddns[.]net,1825
http://memeku.ddns[.]net,1825
http://sap.misapor[.]ch,443
http://update.toythieves[.]com,8080
http://workhard231.hopto[.]org,7070/8821
http://www.eye-watch[.]in,
https://channel.jetos[.]com,443
https://mcf.otzo[.]com,443
https://onlink.epac[.]to,443
https://repview.ignorelist[.]com,443
https://sap.misapor[.]ch,443
https://statis.ignorelist[.]com,443
https://update.toythieves[.]com,443
http://piezasrazonable[.]com,80
http://wmi.mykings[.]top,
http://js.mykings[.]top:280/v.srt,280
http://wmi.mykings[.]top:8888/test.html,8888
http://wmi.mykings[.]top:8888/kill.html,8888
http://coffeol[.]com/fend/lll.exe,
';
$subst = "$3.$5";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php