@Machavity I think you may have not been taking into account the bookending that's done on the watchlist and blacklisted keywords. The regex which you have used is equivalent to
this search on MS, which detects only 29 of the 60 TP which are caught by
binfer
or
binfer(?!\.com)
, which only detect 1 FP from > 1 year ago & that one is debatable.