Match for IP address links in body

[Vlad Mazek]

We've been seeing a ton of spam with links using http/https links to IP 
addresses instead of hostnames.

Has anyone else seen this pattern recently? If so, would you mind sharing a 
rule to match these links in the body of the message?

-Vlad