I agree that metacharacter quoting and nailing down the match to the start of the string with the  ^ anchor are prudent, but my own personal preference would be to use the  \D (non-digit) character class rather than the  \b boundary assertion since this most clearly expresses the intent of the match: no decimal digit follows '18'. (If the IP might lie at the end of the string, I would even be tempted to use a  (?!\d) "negative look-ahead to a digit", although this is arguably "messier" than a simple  \b assertion.)