match regex in payload

The [] pair in a regex matches any single character inside the brackets. So in your example a match is found if the payload contains (, h, t, p, s, etc. Try omitting the square brackets:

[HTTP::payload] matches_regex { (https?|ftp):\/\/.. }