diff --git a/internal/container/level_guesser.go b/internal/container/level_guesser.go
index 2dcdc9ed..e65e1c0a 100644
--- a/internal/container/level_guesser.go
+++ b/internal/container/level_guesser.go
@@ -29,7 +29,7 @@ var aliasToCanonical = map[string]string{}
 //	(?i:^<alt>[^a-z]      // plain prefix:  "error: ..."
 //	|\[ ?<alt> ?\]        // bracketed:     "[ERROR]" / "[ error ]"
 //	| <alt>[/|:-]         // separator:     " error|", " info:" (z2m)
-//	|:<alt>\s)            // colon prefix:  "Tag:info " (z2m)
+//	|\w:<alt>\s)          // tagged:        "Zigbee2MQTT:info " (z2m)
 //	|"<UPPER>"            // quoted:        "\"ERROR\""
 //	|\s<UPPER>\s          // spaced:        " ERROR "
 //
@@ -62,7 +62,7 @@ func init() {
 			`(?i:^` + alt + `[^a-z]` +
 				`|\[ ?` + alt + ` ?\]` +
 				`| ` + alt + `[/|:-]` +
-				`|:` + alt + `\s)` +
+				`|\w:` + alt + `\s)` +
 				`|"` + upper + `"` +
 				`|\s` + upper + `\s`,
 		)
diff --git a/internal/container/level_guesser_test.go b/internal/container/level_guesser_test.go
index b0b406f2..93376e32 100644
--- a/internal/container/level_guesser_test.go
+++ b/internal/container/level_guesser_test.go
@@ -94,6 +94,10 @@ func TestGuessLogLevel(t *testing.T) {
 		{"Zigbee2MQTT:info  2025-12-22 12:00:00: started", "info"},
 		{"Zigbee2MQTT:warn  2025-12-22 12:00:00: queue full", "warn"},
 		{"Zigbee2MQTT:error  2025-12-22 12:00:00: failure", "error"},
+		// False-positive guards: level words embedded in prose or URLs must not match.
+		{"there was an error in the connection info report", "unknown"},
+		{"user information saved successfully", "unknown"},
+		{"GET https://example.com/info returned 200", "unknown"},
 		// Pipe-delimited
 		{"2024-01-01 12:00:00 | ERROR | something went wrong", "error"},
 		{"2024-01-01 12:00:00 | INFO | starting up", "info"},