Regular Expressions 101

Explanation

Pro

1st Alternative((2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)[\.]){3}(2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)

Group 1((2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)[\.]){3}

{3}repeats the group contents below exactly 3 times:

Group 2(2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)

1st Alternative2[0-4]\d

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Character Class[0-4]

0-4one character from 0 (48₁₀) to 4 (52₁₀)

\da digit

2nd Alternative25[0-5]

25the literal text 25

Character Class[0-5]

0-5one character from 0 (48₁₀) to 5 (53₁₀)

3rd Alternative1\d\d

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\da digit

\da digit

4th Alternative0\d\d

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

\da digit

\da digit

5th Alternative0\d

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

\da digit

6th Alternative\d\d

\da digit

\da digit

7th Alternative\d

\da digit

Character Class[\.]

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Group 3(2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)

1st Alternative2[0-4]\d

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Character Class[0-4]

0-4one character from 0 (48₁₀) to 4 (52₁₀)

\da digit

2nd Alternative25[0-5]

25the literal text 25

Character Class[0-5]

0-5one character from 0 (48₁₀) to 5 (53₁₀)

3rd Alternative1\d\d

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\da digit

\da digit

4th Alternative0\d\d

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

\da digit

\da digit

5th Alternative0\d

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

\da digit

6th Alternative\d\d

\da digit

\da digit

7th Alternative\d

\da digit

2nd Alternative(((\w*)://(www)*)\.*((\w*-*\w*)\.)*(\w*)(:\d+)*/*#*(/*)(\w+/)*(\w*\$*\w*\,*\w*\?*=*)*\.*(\w*))

Group 4(((\w*)://(www)*)\.*((\w*-*\w*)\.)*(\w*)(:\d+)*/*#*(/*)(\w+/)*(\w*\$*\w*\,*\w*\?*=*)*\.*(\w*))

Group 5((\w*)://(www)*)

\.*the literal . (46₁₀ / 56₈ / 2E₁₆) , repeated any number of times

Group 8((\w*-*\w*)\.)*

Group 10(\w*)

Group 11(:\d+)*

/*the literal / (47₁₀ / 57₈ / 2F₁₆) , repeated any number of times

#*the literal # (35₁₀ / 43₈ / 23₁₆) , repeated any number of times

Group 12(/*)

Group 13(\w+/)*

Group 14(\w*\$*\w*\,*\w*\?*=*)*

\.*the literal . (46₁₀ / 56₈ / 2E₁₆) , repeated any number of times

Group 15(\w*)

3rd Alternative((www\.)*(\w+-*)(\.\w+)+)(:\d+)*/*#*(/*)(\w+/)*(\w*\$*\w*\,*\w*\?*=*)*\.*(\w*)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Match Information

Detailed match information will be displayed here automatically.

Quick Reference

25 tokens

Regular Expression

((2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)[\.]){3}(2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)|(((\w*)://(www)*)\.*((\w*-*\w*)\.)*(\w*)(:\d+)*/*#*(/*)(\w+/)*(\w*\$*\w*\,*\w*\?*=*)*\.*(\w*))|((www\.)*(\w+-*)(\.\w+)+)(:\d+)*/*#*(/*)(\w+/)*(\w*\$*\w*\,*\w*\?*=*)*\.*(\w*)

hxxp://securedownload2.duckdns.org:7373/docs/ @JAMESWT_MHT
abc://www.hhghg.ghgh.jkjkjk.jkjkj.jkjk
#LokiBot @ hxxp://xupfile.duckdns.org:1133/$59,200.exe 
https://www.reverse.it/sample/529b10d3faaa143c074d0f25ee75c8e9bad7f5982ead482d6c0c19a39d207b68?environmentId=100 …
1.2.3.4
www.virustotal.com
C2: hta.duckdns.org:7373/excel/fre.php
http://www.virustotal.com/en/file/a94f7db23f64985f22a4250886db0d67e3cc1fbf59ef3d1bf9ffd28d3357d3f7/analysis/1511168707/ …
Downloads from hxxp://172.106.75.131/temp/amazingdoz.exe d
https://www.virustotal.com/#/url/2512afa822b8cadbe9e2fa0ecda5ad55d6024b0694fecf265282a63ef88058cf/detection   …
hxxp://www.dk-fyn.dk/ebgate/ri.php
hxxp://www.fourthtour.it/rus/tour/php.scr
hxxp://www.foxydance.cz/repository/ri.php
hxxp://www.sabineclaire.com/girasoli/ri.php,1212 sdfsdfsdsdfsdf
https://www.reverse.it/sample/b57bd0dec0873bea8e47a16e1da41aafa817ae11d536c90cb7aec6d6686b686e?environmentId=100 …
hxxp://www.sabineclaire.com/girasoli/ri.php
sdf.bom
fasdkj adsflk jasldk f