Regex would fail because of garbage-in garbage-out.
The whole point of IP shadowing is to prevent what you're trying to do, unless you've been given OPER privileges because you need it. When $address(nick,3) shows a hostname like *.DEADBEEF.DEADBEEF.IP, you can't use /dns to resolve it because it's not a 'real' host name. There may be ways to peel back the disguise to see the IP behind the cloak, but it would be difficult for scripts to do that, and if I were to post such an exploit other than the obvious tricks, the post would get deleted.
Obvious tricks are things like trying to use DCC SEND to discover someone's IP, which is why some networks only allow receiving files when you've put someone on a DCCALLOW list. Or if you control a website where you can see the IP addresses that connect to it, and get someone to open a link in their browser, assuming everyone will click on a mystery link from someone they don't know.
