on @*:TEXT:*http*.exe*:#: if $badhttp($1-) { msg # works. } alias badhttp return $regex($1,/http:\/\/([01]?\d\d?|2[0-4]\d|25[0-5])\.(?1)\.(?1)\.(?1)\/[^\s]+\.exe/Sig)