The following filter log extract sums it up well: [2021-11-14 10:39:10] header value [ from evenas.org (localhost [127.0.0.1]) by evenas.org (8.16.1/8.16.1) with ESMTP id 1AE339TH023255 for <root@evenas.org>; Sun, 14 Nov 2021 03:03:09 GMT (envelope-from root@evenas.org) ] does NOT match regular expression [ \[41\.25[2-5]\. ] (Case insensitive) [2021-11-14 10:39:10] header value [ from evenas.org (localhost [127.0.0.1]) by evenas.org (8.16.1/8.16.1) with ESMTP id 1AE339TH023255 for <root@evenas.org>; Sun, 14 Nov 2021 03:03:09 GMT (envelope-from root@evenas.org) ] does NOT contain [ [46.105 ] (Case insensitive) [2021-11-14 10:39:10] header value [ from evenas.org (localhost [127.0.0.1]) by evenas.org (8.16.1/8.16.1) with ESMTP id 1AE339TH023255 for <root@evenas.org>; Sun, 14 Nov 2021 03:03:09 GMT (envelope-from root@evenas.org) ] matches regular expression [ \[51\.(178)|(25[4,5]) ] (Case insensitive) > message matches [2021-11-14 10:39:10] applying action [ move "#mh/Local Folders/trash" ] The opening "\[" should be interpreted as a literal "[", anchoring the RE to substrings beginning with that character, in this context to IP addresses. It is most definitely not the beginning of a bracket expression. The RE should only match "[51." followed by "178", "254" or "255". There is no "[51." in the header, so it should not match. It can only match if the opening "\" is ignored and the "[" is then used to open a bracketed expression matching a "5","1","\",".","(","7","8",")","|","2", or "4" followed by a ")". That would then match the "1)" at the end of "(8.16.1/8.16.1)". This is clearly not intended. Steps to reproduce: 1. Create an e-mail containing the header "Received: from evenas.org (localhost [127.0.0.1]) by evenas.org (8.16.1/8.16.1) with ESMTP id 1AE339TH023255 for <root@evenas.org>; Sun, 14 Nov 2021 03:03:09 GMT (envelope-from root@evenas.org)" and place it in a folder in a Claws Mail account. 2. Create a filter rule for a Received header to match "\[51\.(178)|(25[4,5])" as a regular expression, with a non-destructive action. 3. Enable filter logging and set the logging level to high. 4. Select the message and filter selected. 5. View the log. Result: The message matches the filter condition. Expected Result: The message should not match.