<p>我猜s<code>mode</code>上的这个表达式可能会返回这些IP:</p>
<pre><code>403.*?403.*?\s{2,}(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
</code></pre>
<p>或具有更多边界:</p>
<pre><code>"\s+\b403\b.*?"\s+\b403\b.*?\s{2,}(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
</code></pre>
<h3><a href="https://regex101.com/r/SLcBlc/1/" rel="nofollow noreferrer">Demo</a></h3>
<h3>测试</h3>
<pre><code>import re
regex = r"403.*?403.*?\s{2,}(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
test_str = """
12.115.14.240 - - [29/Aug/2017:04:40:03 -0400] "GET /apng/assembler-2.0/assembler2.php HTTP/1.1" 403 231 "http://littlesvr.ca/apng/history.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36"
202.167.250.99 - - [29/Aug/2017:04:41:10 -0400] "GET /apng/images/o_sample.png?1424751982?1424776117 HTTP/1.1" 403 115656 "http://bbs.mydigit.cn/read.php?tid=2186780&fpage=3" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
120.115.144.240 - - [29/Aug/2017:04:40:03 -0400] "GET /apng/assembler-2.0/assembler2.php HTTP/1.1" 200 231 "http://littlesvr.ca/apng/history.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36"
12.115.14.240 - - [29/Aug/2017:04:40:03 -0400] "GET /apng/assembler-2.0/assembler2.php HTTP/1.1" 403 231 "http://littlesvr.ca/apng/history.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36"
202.167.250.99 - - [29/Aug/2017:04:41:10 -0400] "GET /apng/images/o_sample.png?1424751982?1424776117 HTTP/1.1" 403 115656 "http://bbs.mydigit.cn/read.php?tid=2186780&fpage=3" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"
120.115.144.240 - - [29/Aug/2017:04:40:03 -0400] "GET /apng/assembler-2.0/assembler2.php HTTP/1.1" 200 231 "http://littlesvr.ca/apng/history.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36"
"""
print(re.findall(regex, test_str, re.DOTALL))
</code></pre>
<h3>输出</h3>
<pre><code>['120.115.144.240', '120.115.144.240']
</code></pre>
<p>表达式在<a href="https://regex101.com/r/p8yyKR/1/" rel="nofollow noreferrer">regex101.com</a>的右上角面板上解释,如果您希望探索/简化/修改它,在<a href="https://regex101.com/r/p8yyKR/1/debugger" rel="nofollow noreferrer">this link</a>中,您可以查看它如何与一些示例输入匹配(如果您愿意)。你知道吗</p>
<h3>正则表达式电路</h3>
<p><a href="https://jex.im/regulex/#!flags=&re=%5E(a%7Cb)*%3F%24" rel="nofollow noreferrer">jex.im</a>可视化正则表达式:</p>
<p><a href="https://i.stack.imgur.com/DZqan.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DZqan.png" alt="enter image description here"/></a></p>