I want to know why events still appear from IP addresses I added to the project’s IP address inbound filter.

The IP inbound filter checks the client IP that sends the event to Sentry, not the user IP included in the event payload. If you copy an IP address from an issue's user context, it may be different from the request IP that Sentry sees, which means the inbound filter won't match and the event won't be dropped.

First, make sure your filter uses a supported IP format, such as an IPv4 address, IPv6 address, or CIDR range. See the IP address inbound filter documentation for details.

You should then filter using the IP address that actually reaches Sentry, including the forwarded IP when applicable.

Sentry only uses CF-Connecting-IP, X-Vercel-Forwarded-For, X-Sentry-Forwarded-For, and X-Forwarded-For to determine a forwarded client IP.

Other headers, such as X-Cluster-Client-Ip, are ignored.

If you need to filter based on an IP address stored inside the event payload instead, use SDK-level filtering such as beforeSend. For an example, see How can I ignore errors coming from certain IP addresses?