A couple of other variations if you want to find the first square-bracketed IP before a specific | specific literal trigger phrase:

c:\@Work\Perl\monks>perl -wMstrict -le
"use Regexp::Common qw(net);
 ;;
 my $line = 'xxx[9.9.9.9] virtuals.cl[131.221.34.13]: 454 9.9.9.9: Rel
+ay access denied; helo=[9.9.9.9]';
 ;;
 my $sq_ip   = qr{ (?<= \[) $RE{net}{IPv4} (?= \]) }xms;
 my $trigger = 'Relay access denied';
 ;;
 if (my ($denied_ip) = $line =~ m{ ($sq_ip) (?: (?! $sq_ip) .)*? \Q$tr
+igger\E  }xms) {
   print qq{matched: '$denied_ip'};
   }
 ;;
 my $found_denied = my ($ip_denied) = $line =~ m{ ($sq_ip) (?: (?! $sq
+_ip) .)*? \Q$trigger\E }xms;
 print qq{  found: '$ip_denied'} if $found_denied;
"
matched: '131.221.34.13'
  found: '131.221.34.13'
[download]