I'm using the strpos because I'm printing more than just the IP per line. I use a tag to identify what layer of my agorithm blocked the IP.
It is something like this: LAYER1 - BLOECKED_IP\n
Then.. strpos is working well for me in this format.
I can understand what you mean, and if it works well for you then there is little point to change it. However, I was just pointing out that strpos can return incorrect strings under certain circumstances. If you're not too worried about a fairly small amount of real users not being able to access your site there is no need to change your code.
If you really wanted to change it though, you could probably just use explode and str_replace to get the IP alone. Something like this:
$explodedStr = explode(' ', 'LAYER1 - BLOECKED_IP\n');
$finalIP = str_replace("\n", '', $explodedStr);
Obviously it will probably need some tinkering as in my experience these sorts of things never tend to work first time, though you could probably hack around it if you needed to.