$re = '`((2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)[\.]){3}(2[0-4]\d|25[0-5]|1\d\d|0\d\d|0\d|\d\d|\d)|(((\w*)://(www)*)\.*((\w*-*\w*)\.)*(\w*)(:\d+)*/*#*(/*)(\w+/)*(\w*\$*\w*\,*\w*\?*=*)*\.*(\w*))|((www\.)*(\w+-*)(\.\w+)+)(:\d+)*/*#*(/*)(\w+/)*(\w*\$*\w*\,*\w*\?*=*)*\.*(\w*)`m';
$str = 'hxxp://securedownload2.duckdns.org:7373/docs/ @JAMESWT_MHT
abc://www.hhghg.ghgh.jkjkjk.jkjkj.jkjk
#LokiBot @ hxxp://xupfile.duckdns.org:1133/$59,200.exe
https://www.reverse.it/sample/529b10d3faaa143c074d0f25ee75c8e9bad7f5982ead482d6c0c19a39d207b68?environmentId=100 …
1.2.3.4
www.virustotal.com
C2: hta.duckdns.org:7373/excel/fre.php
http://www.virustotal.com/en/file/a94f7db23f64985f22a4250886db0d67e3cc1fbf59ef3d1bf9ffd28d3357d3f7/analysis/1511168707/ …
Downloads from hxxp://172.106.75.131/temp/amazingdoz.exe d
https://www.virustotal.com/#/url/2512afa822b8cadbe9e2fa0ecda5ad55d6024b0694fecf265282a63ef88058cf/detection …
hxxp://www.dk-fyn.dk/ebgate/ri.php
hxxp://www.fourthtour.it/rus/tour/php.scr
hxxp://www.foxydance.cz/repository/ri.php
hxxp://www.sabineclaire.com/girasoli/ri.php,1212 sdfsdfsdsdfsdf
https://www.reverse.it/sample/b57bd0dec0873bea8e47a16e1da41aafa817ae11d536c90cb7aec6d6686b686e?environmentId=100 …
hxxp://www.sabineclaire.com/girasoli/ri.php
sdf.bom
fasdkj adsflk jasldk fjalskd fjslaskjdf lkaj dsfl';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php