Sorry, Kenneth, I had not seen anywhere any specification that there is an empty line delimiting the IP and URL blocks. Rereading the whole thread, it is true that the data pseudo-sample provided has one such separator, but is there any guarantee that there are just one IP block and one URL block and not several blocks of each type? Or that the block will always really be in that order?

I personally would not rely on that unless I have a firm commitment from the data supplier that it will be always this way and exactly this way (or unless I am producing myself the data, say in another application). In brief, I still think it would be safer and more robust to perform some validation of the type of data at hand (but, of course, with a better regex than the really basic one I provided).