Service abuse: Demio notifications with suspicious content patterns

type.inbound
//
//  Warning: This rule contains sexually explicit keywords
//
and sender.email.email == 'notifications@demio.com'
and (
  // phone number regex
  regex.icontains(subject.base,
                  '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                  '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
  )
  // dollar amounts
  or regex.icontains(subject.base, '(?:USD
| \$)\s?\d')
  or regex.icontains(subject.base, '\d+\.\d{2}\s?(?:USD
| usd)')
  // suspicious TLDs
  or regex.icontains(subject.base,
                     '\.(?:ac\.th
| biz\.id
| co\.(?:cl
| id
| za)
| com\.(?:ge
| py)
| my\.id
| ne\.jp
| net\.ms
| nom\.za
| web\.id
| accountants
| am
| app
| ar
| army
| beauty
| best
| bet
| bio
| biz
| bond
| cam
| cc
| cf
| cfd
| chat
| cl
| click
| cloud
| club
| cm
| company
| consulting
| country
| cricket
| cyou
| date
| dev
| digital
| directory
| domains
| download
| enterprises
| es
| expert
| fashion
| finance
| fit
| foo
| free
| fun
| ga
| gdn
| gf
| gq
| gu
| help
| i2p
| icu
| il
| ing
| ink
| ir
| jetzt
| kim
| kz
| lat
| life
| limited
| link
| live
| loan
| lol
| ltd
| ly
| me
| meme
| men
| ml
| mom
| monster
| mov
| mq
| one
| online
| ooo
| party
| photos
| pictures
| pizza
| press
| pro
| pub
| pw
| racing
| re
| ren
| rest
| review
| ro
| rsvp
| ru
| run
| sale
| sbs
| science
| shop
| site
| so
| social
| solutions
| space
| store
| stream
| su
| sx
| tech
| tk
| today
| tokyo
| top
| trade
| tt
| ua
| uno
| us
| vip
| vu
| wang
| website
| win
| work
| works
| world
| ws
| xin
| xyz
| zip
| zone)\b'
  )
  // dating/spam/explicit content lures
  or regex.icontains(strings.replace_confusables(subject.base),
                     '(?:\bs\s?e\s?x\b
| horny
| hook.?up
| private room
| wanna meet
| wants to meet
| naked
| porn
| webcam
| nudes?
| sexting
| erotic
| kinky
| seduce
| adult community
| cam shows
| local (?:girls?
| women
| single)
| bed partner)'
  )
  // action verbs + length
  or (
    strings.count(subject.base, " ") > 8
    and regex.icontains(strings.replace_confusables(subject.base),
                        '(?:call
| dial
| speak to
| contact \d
| to (?:stop
| void
| reverse
| confirm
| secure
| verify
| unfreeze))'
    )
  )
)