substr, or ereg:
ereg('http://([[:alnum:].-]+\.[[:alpha:]]+)', $_SERVER['HTTP_REFERER'], $regs);
echo $reg[1];
That should output the domain name. If you want to use IP addresses, you should instead use:
ereg('http://([[:alnum:]]{1,3}\.[[:alnum:]]{1,3}\.[[:alnum:]]{1,3}\.[[:alnum:]]{1,3})', $_SERVER['HTTP_REFERER'], $regs);
echo $reg[1];