svn commit: r1932356 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Tue Mar 17 09:52:41 2026
New Revision: 1932356

Log:
Add new rules for specific phone numbers observed in scams.

Added:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf

Added: spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Tue Mar 17 09:52:41 2026	(r1932356)
@@ -0,0 +1,154 @@
+
+#
+# 20_phonescam.cf
+# Phone numbers appearing in order/payment confirmation scam spam
+# ("call our support if this was not you" -- the call is the goal)
+#
+# Generated: 2026-03-17 02:25:02 PDT
+#
+# Optionally uses Mail::SpamAssassin::Plugin::ReplaceTags for digit/separator
+# obfuscation coverage.  If the plugin is not available, plain-regex fallbacks
+# define the same subrule names so the scored metas below always work.
+#
+# Campaigns observed:
+#   983-220-xxxx  Generic fake invoice/billing (area code 983 is UNASSIGNED in NANP)
+#   970-303-xxxx  Fake PayPal/Apple order confirmations (calendar spam delivery)
+#   865-xxx-xxxx  Fake Norton LifeLock / Geek Squad renewals (multiple exchanges)
+#   812-266-xxxx  Fake Microsoft account security alerts
+#   838-209-xxxx  Generic fake invoice (adjacent numbers in pool)
+#   859-204-xxxx  Geek Squad fake renewals
+#   misc          Various singletons from the above campaigns
+#
+# Digit obfuscation (ReplaceTags branch):
+#   <O> from 25_replace.cf covers digit 0 / letter O lookalikes
+#   <I> from 25_replace.cf covers digit 1 / letter l/I lookalikes
+#
+# Digit obfuscation (plain branch):
+#   [0oO] for digit 0 / letter O
+#   [1lI|] for digit 1 / letter l/I
+#
+# Separator obfuscation (PSEP):
+#   One optional character between digit groups: -, ., space, underscore.
+#   Area code parens handled separately with \(?...\)?.
+#   Middle-ground choice: allows common visual separators but not arbitrary strings.
+#
+# Rule structure:
+#   One unscored subrule per AC+exchange group (named __PHONESCAM_AC_EXCH).
+#   One unscored OR meta __PHONESCAM_ALL over all subrules.
+#   Scored meta PHONE_ORDERSCAM references __PHONESCAM_ALL.
+#
+
+ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
+
+replace_tag PSEP  [-. _\s]?
+
+#---------------------------------------------------------------------------
+# 983-xxxx-xxxx  (area code 983 is UNASSIGNED in NANP)
+# Any phone number in this AC is inherently suspicious.
+# Two tiers:
+#   __PHONESCAM_983_ANY    -- any number in AC 983
+#   __PHONESCAM_983_220    -- observed exchange+subscriber combinations (higher confidence)
+#   __PHONESCAM_983_NOVEL  -- AC 983, but NOT an already-observed number (lower confidence)
+#---------------------------------------------------------------------------
+
+# Matches any syntactically valid NANP number in AC 983.
+# Exchange first digit restricted to [2-9] per NANP rules.
+body __PHONESCAM_983_ANY  /(?:\+?<I><PSEP>)?\(?983\)?<PSEP>[2-9]\d\d<PSEP>\d{4}/
+replace_rules __PHONESCAM_983_ANY
+
+# Observed: exchange 220, subscriber 2061 2081 2086 2158 2169 2356 2386 2407 2418 2512 2513 2531 2548 2552 2571 2586 2588 2623 2632 2795 2848 2853 2857
+body __PHONESCAM_983_220  /(?:\+?<I><PSEP>)?\(?983\)?<PSEP>22<O><PSEP>(?:2<O>6<I>|2<O>8<I>|2<O>86|2<I>58|2<I>69|2356|2386|24<O>7|24<I>8|25<I>[23]|253<I>|2548|2552|257<I>|258[68]|2623|2632|2795|2848|285[37])/
+replace_rules __PHONESCAM_983_220
+
+#---------------------------------------------------------------------------
+# 970-303-xxxx  (fake PayPal/Apple order confirmations; calendar spam delivery)
+# Observed: 2135 2184 2319 2457 2563 2645
+#---------------------------------------------------------------------------
+body __PHONESCAM_970_303  /(?:\+?<I><PSEP>)?\(?97<O>\)?<PSEP>3<O>3<PSEP>(?:2<I>35|2<I>84|23<I>9|2457|2563|2645)/
+replace_rules __PHONESCAM_970_303
+
+#---------------------------------------------------------------------------
+# 865-209-xxxx  (fake Norton LifeLock / Geek Squad renewals)
+# Observed: 0164 0221
+#---------------------------------------------------------------------------
+body __PHONESCAM_865_209  /(?:\+?<I><PSEP>)?\(?865\)?<PSEP>2<O>9<PSEP>(?:<O><I>64|<O>22<I>)/
+replace_rules __PHONESCAM_865_209
+
+#---------------------------------------------------------------------------
+# 865-223-xxxx  (fake Norton LifeLock renewals)
+# Observed: 0873 1294
+#---------------------------------------------------------------------------
+body __PHONESCAM_865_223  /(?:\+?<I><PSEP>)?\(?865\)?<PSEP>223<PSEP>(?:<O>873|<I>294)/
+replace_rules __PHONESCAM_865_223
+
+#---------------------------------------------------------------------------
+# 812-266-xxxx  (fake Microsoft account security alerts)
+# Observed: 1510 1890
+#---------------------------------------------------------------------------
+body __PHONESCAM_812_266  /(?:\+?<I><PSEP>)?\(?8<I>2\)?<PSEP>266<PSEP>(?:<I>5<I><O>|<I>89<O>)/
+replace_rules __PHONESCAM_812_266
+
+#---------------------------------------------------------------------------
+# 838-209-xxxx  (generic fake invoice; adjacent pool numbers)
+# Observed: 0187 0188
+#---------------------------------------------------------------------------
+body __PHONESCAM_838_209  /(?:\+?<I><PSEP>)?\(?838\)?<PSEP>2<O>9<PSEP><O><I>8[78]/
+replace_rules __PHONESCAM_838_209
+
+#---------------------------------------------------------------------------
+# 859-204-xxxx  (Geek Squad fake renewals)
+# Observed: 6980 6984
+#---------------------------------------------------------------------------
+body __PHONESCAM_859_204  /(?:\+?<I><PSEP>)?\(?859\)?<PSEP>2<O>4<PSEP>(?:698<O>|6984)/
+replace_rules __PHONESCAM_859_204
+
+#---------------------------------------------------------------------------
+# Miscellaneous singletons
+# 801-306-9512  801-346-6088
+# 802-210-7436  802-346-3153
+# 803-210-5063  805-507-3804
+# 833-379-0781  843-200-1039
+# 859-222-1162  865-283-4987
+#---------------------------------------------------------------------------
+body __PHONESCAM_MISC  /(?:\+?<I><PSEP>)?(?:\(?8<O><I>\)?<PSEP>(?:3<O>6<PSEP>95<I>2|346<PSEP>6<O>88)|\(?8<O>2\)?<PSEP>(?:2<I><O><PSEP>7436|346<PSEP>3<I>53)|\(?8<O>3\)?<PSEP>2<I><O><PSEP>5<O>63|\(?8<O>5\)?<PSEP>5<O>7<PSEP>38<O>4|\(?833\)?<PSEP>379<PSEP><O>78<I>|\(?843\)?<PSEP>2<O><O><PSEP><I><O>39|\(?859\)?<PSEP>222<PSEP><I><I>62|\(?865\)?<PSEP>283<PSEP>4987)/
+replace_rules __PHONESCAM_MISC
+
+else  # Mail::SpamAssassin::Plugin::ReplaceTags not available -- plain fallbacks
+
+body __PHONESCAM_983_ANY  /(?:\+?[1lI|][-. _]?)?\(?983\)?[-. _]?[2-9]\d\d[-. _]?\d{4}/
+
+body __PHONESCAM_983_220  /(?:\+?[1lI|][-. _]?)?\(?983\)?[-. _]?22[0oO][-. _]?(?:2[0oO]6[1lI|]|2[0oO]8[1lI|]|2[0oO]86|2[1lI|]58|2[1lI|]69|2356|2386|24[0oO]7|24[1lI|]8|25[1lI|][23]|253[1lI|]|2548|2552|257[1lI|]|258[68]|2623|2632|2795|2848|285[37])/
+
+body __PHONESCAM_970_303  /(?:\+?[1lI|][-. _]?)?\(?97[0oO]\)?[-. _]?3[0oO]3[-. _]?(?:2[1lI|]35|2[1lI|]84|23[1lI|]9|2457|2563|2645)/
+
+body __PHONESCAM_865_209  /(?:\+?[1lI|][-. _]?)?\(?865\)?[-. _]?2[0oO]9[-. _]?(?:[0oO][1lI|]64|[0oO]22[1lI|])/
+
+body __PHONESCAM_865_223  /(?:\+?[1lI|][-. _]?)?\(?865\)?[-. _]?223[-. _]?(?:[0oO]873|[1lI|]294)/
+
+body __PHONESCAM_812_266  /(?:\+?[1lI|][-. _]?)?\(?8[1lI|]2\)?[-. _]?266[-. _]?(?:[1lI|]5[1lI|][0oO]|[1lI|]89[0oO])/
+
+body __PHONESCAM_838_209  /(?:\+?[1lI|][-. _]?)?\(?838\)?[-. _]?2[0oO]9[-. _]?[0oO][1lI|]8[78]/
+
+body __PHONESCAM_859_204  /(?:\+?[1lI|][-. _]?)?\(?859\)?[-. _]?2[0oO]4[-. _]?(?:698[0oO]|6984)/
+
+body __PHONESCAM_MISC  /(?:\+?[1lI|][-. _]?)?(?:\(?8[0oO][1lI|]\)?[-. _]?(?:3[0oO]6[-. _]?95[1lI|]2|346[-. _]?6[0oO]88)|\(?8[0oO]2\)?[-. _]?(?:2[1lI|][0oO][-. _]?7436|346[-. _]?3[1lI|]53)|\(?8[0oO]3\)?[-. _]?2[1lI|][0oO][-. _]?5[0oO]63|\(?8[0oO]5\)?[-. _]?5[0oO]7[-. _]?38[0oO]4|\(?833\)?[-. _]?379[-. _]?[0oO]78[1lI|]|\(?843\)?[-. _]?2[0oO][0oO][-. _]?[1lI|][0oO]39|\(?859\)?[-. _]?222[-. _]?[1lI|][1lI|]62|\(?865\)?[-. _]?283[-. _]?4987)/
+
+endif  # Mail::SpamAssassin::Plugin::ReplaceTags
+
+#---------------------------------------------------------------------------
+# Combined unscored OR meta -- reference this in scored rules and exclusions
+#---------------------------------------------------------------------------
+meta __PHONESCAM_ALL  __PHONESCAM_983_220 || __PHONESCAM_970_303 || __PHONESCAM_865_209 || __PHONESCAM_865_223 || __PHONESCAM_812_266 || __PHONESCAM_838_209 || __PHONESCAM_859_204 || __PHONESCAM_MISC
+
+# AC 983 novel: unassigned AC but not a confirmed-observed number
+meta __PHONESCAM_983_NOVEL  __PHONESCAM_983_ANY && !__PHONESCAM_983_220
+
+meta     PHONE_ORDERSCAM   __PHONESCAM_ALL
+score    PHONE_ORDERSCAM   2.500	# limit
+describe PHONE_ORDERSCAM   Body contains known order/payment confirmation scam phone number
+tflags   PHONE_ORDERSCAM   publish
+
+meta     PHONE_983_NOVEL   __PHONESCAM_983_NOVEL
+score    PHONE_983_NOVEL   1.500	# limit
+describe PHONE_983_NOVEL   Body contains phone number in unassigned NANP area code 983
+tflags   PHONE_983_NOVEL   publish