That pattern may be a North American number. If it is, please use a format which starts with an optional `1` followed by possible separator text and has the main number in the format `815-988-1648` where `-` could be a single alpha character or any `[\W_]*+`. Alternately, you can add the comment `(?#IS NorAm)` to the end of the pattern to force also using the alternate normalized form, or `(?#NO NorAm)` if it's not a North American phone number and it's incorrectly recognized as one. Perhaps try

> Bad ip for hostname in body, bad ip for hostname in title, bad ns for domain in body, bad ns for domain in title, blacklisted website in body, blacklisted website in title, potentially bad ns for domain in body, potentially bad ns for domain in title, potentially bad keyword in body, potentially bad keyword in title, potentially bad keyword in username
----------
Bad ip for hostname in body - printertollfreenumber.com suspicious IP address 198.46.134.225
Bad ip for hostname in title - printertollfreenumber.com suspicious IP address 198.46.134.225