You are comparing the URI for containment of the string "***.***.***.148" Do your URI's really contain this string?
http://www.foo.com/path/***.***.***.148/file.jpg
Also, just wanted to make sure to make sure you knew that the "contains" operator doesn't work on wildcards so it would be comparing for an exact string match. Just in case your uri's had an address embedded in them. You'd have to do a regular expression match or a switch/glob option for this to work.
If you are trying to mask off of a client or virtual address, you are going to have to use one of the IP::*_addr methods to extract that value for comparison.
I'm still trying to figure out why you are masking out all but the last value, it's usually the other way around. This would mean that anyone coming in with an address ending in 148 would be allowed access.
More details would really help us help you...
-Joe