Author: jhardin
Date: Sat Mar 21 02:24:04 2026
New Revision: 1932424
Log:
use replacetags digit patterns
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf Sat Mar 21 02:01:36 2026 (r1932423)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf Sat Mar 21 02:24:04 2026 (r1932424)
@@ -4,7 +4,7 @@
# Phone numbers appearing in order/payment confirmation scam spam
# ("call our support if this was not you" -- the call is the goal)
#
-# Generated: 2026-03-20 18:04:15 PDT
+# Generated: 2026-03-20 19:15:52 PDT
#
# Optionally uses Mail::SpamAssassin::Plugin::ReplaceTags for digit/separator
# obfuscation coverage. If the plugin is not available, plain-regex fallbacks
@@ -20,12 +20,12 @@
# misc Various singletons from the above campaigns
#
# Digit obfuscation (ReplaceTags branch):
-# <O> from 25_replace.cf covers digit 0 / letter O lookalikes
-# <I> from 25_replace.cf covers digit 1 / letter l/I lookalikes
+# <0>..<9> from 25_replace.cf cover each digit and its unicode lookalikes
#
# Digit obfuscation (plain branch):
# [0oO] for digit 0 / letter O
# [1lI|] for digit 1 / letter l/I
+# literal digits for 2-9 (unicode math variants not covered)
#
# Separator obfuscation (PSEP):
# One optional character between digit groups: -, ., space, underscore.
@@ -42,6 +42,10 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
replace_tag PSEP [-. _\s]?
+# D29: any single digit 2-9 with common unicode lookalikes (NANP NXX first-digit)
+# <DIGIT> (any digit 0-9) is defined globally in 25_replace.cf
+replace_tag D29 (?:[2-9zZsS]|(?-i:[GgqA])|[\xef][\xbc][\x92-\x99]|[\xf0][\x9d][\x9f][\x90-\x97\x9a-\xa1\xa4-\xab\xae-\xb5\xb8-\xbf])
+
#---------------------------------------------------------------------------
# 983-xxxx-xxxx (area code 983 is UNASSIGNED in NANP)
# Any phone number in this AC is inherently suspicious.
@@ -53,53 +57,53 @@ replace_tag PSEP [-. _\s]?
# Matches any syntactically valid NANP number in AC 983.
# Exchange first digit restricted to [2-9] per NANP rules.
-body __PHONESCAM_983_ANY /(?:\+?<I><PSEP>)?\(?983\)?<PSEP>[2-9]\d\d<PSEP>\d{4}/
+body __PHONESCAM_983_ANY /(?:\+?<1><PSEP>)?\(?<9><8><3>\)?<PSEP><D29><DIGIT><DIGIT><PSEP><DIGIT>{4}/
replace_rules __PHONESCAM_983_ANY
# Observed: exchange 220, subscriber 2061 2081 2086 2158 2169 2356 2386 2407 2418 2512 2513 2531 2548 2552 2571 2586 2588 2623 2632 2795 2848 2853 2857
-body __PHONESCAM_983_220 /(?:\+?<I><PSEP>)?\(?983\)?<PSEP>22<O><PSEP>(?:2<O>6<I>|2<O>8<I>|2<O>86|2<I>58|2<I>69|2356|2386|24<O>7|24<I>8|25<I>[23]|253<I>|2548|2552|257<I>|258[68]|2623|2632|2795|2848|285[37])/
+body __PHONESCAM_983_220 /(?:\+?<1><PSEP>)?\(?<9><8><3>\)?<PSEP><2><2><0><PSEP>(?:<2><0>(?:<6><1>|<8>(?:<1>|<6>))|<2><1>(?:<5><8>|<6><9>)|<2><3>(?:<5><6>|<8><6>)|<2><4>(?:<0><7>|<1><8>)|<2><5>(?:<1>(?:<2>|<3>)|<3><1>|<4><8>|<5><2>|<7><1>|<8>(?:<6>|<8>))|<2><6>(?:<2><3>|<3><2>)|<2><7><9><5>|<2><8>(?:<4><8>|<5>(?:<3>|<7>)))/
replace_rules __PHONESCAM_983_220
#---------------------------------------------------------------------------
# 970-303-xxxx (fake PayPal/Apple order confirmations; calendar spam delivery)
# Observed: 2135 2184 2319 2451 2457 2563 2645
#---------------------------------------------------------------------------
-body __PHONESCAM_970_303 /(?:\+?<I><PSEP>)?\(?97<O>\)?<PSEP>3<O>3<PSEP>(?:2<I>35|2<I>84|23<I>9|245<I>|2457|2563|2645)/
+body __PHONESCAM_970_303 /(?:\+?<1><PSEP>)?\(?<9><7><0>\)?<PSEP><3><0><3><PSEP>(?:<2><1>(?:<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6><3>|<2><6><4><5>)/
replace_rules __PHONESCAM_970_303
#---------------------------------------------------------------------------
# 865-209-xxxx (fake Norton LifeLock / Geek Squad renewals)
# Observed: 0164 0221
#---------------------------------------------------------------------------
-body __PHONESCAM_865_209 /(?:\+?<I><PSEP>)?\(?865\)?<PSEP>2<O>9<PSEP>(?:<O><I>64|<O>22<I>)/
+body __PHONESCAM_865_209 /(?:\+?<1><PSEP>)?\(?<8><6><5>\)?<PSEP><2><0><9><PSEP>(?:<0>(?:<1><6><4>|<2><2><1>))/
replace_rules __PHONESCAM_865_209
#---------------------------------------------------------------------------
# 865-223-xxxx (fake Norton LifeLock renewals)
# Observed: 0873 1294
#---------------------------------------------------------------------------
-body __PHONESCAM_865_223 /(?:\+?<I><PSEP>)?\(?865\)?<PSEP>223<PSEP>(?:<O>873|<I>294)/
+body __PHONESCAM_865_223 /(?:\+?<1><PSEP>)?\(?<8><6><5>\)?<PSEP><2><2><3><PSEP>(?:<0><8><7><3>|<1><2><9><4>)/
replace_rules __PHONESCAM_865_223
#---------------------------------------------------------------------------
# 812-266-xxxx (fake Microsoft account security alerts)
# Observed: 1510 1890
#---------------------------------------------------------------------------
-body __PHONESCAM_812_266 /(?:\+?<I><PSEP>)?\(?8<I>2\)?<PSEP>266<PSEP>(?:<I>5<I><O>|<I>89<O>)/
+body __PHONESCAM_812_266 /(?:\+?<1><PSEP>)?\(?<8><1><2>\)?<PSEP><2><6><6><PSEP><1>(?:<5><1>|<8><9>)<0>/
replace_rules __PHONESCAM_812_266
#---------------------------------------------------------------------------
# 838-209-xxxx (generic fake invoice; adjacent pool numbers)
# Observed: 0187 0188
#---------------------------------------------------------------------------
-body __PHONESCAM_838_209 /(?:\+?<I><PSEP>)?\(?838\)?<PSEP>2<O>9<PSEP><O><I>8[78]/
+body __PHONESCAM_838_209 /(?:\+?<1><PSEP>)?\(?<8><3><8>\)?<PSEP><2><0><9><PSEP><0><1><8>(?:<7>|<8>)/
replace_rules __PHONESCAM_838_209
#---------------------------------------------------------------------------
# 859-204-xxxx (Geek Squad fake renewals)
# Observed: 6980 6984
#---------------------------------------------------------------------------
-body __PHONESCAM_859_204 /(?:\+?<I><PSEP>)?\(?859\)?<PSEP>2<O>4<PSEP>(?:698<O>|6984)/
+body __PHONESCAM_859_204 /(?:\+?<1><PSEP>)?\(?<8><5><9>\)?<PSEP><2><0><4><PSEP><6><9><8>(?:<0>|<4>)/
replace_rules __PHONESCAM_859_204
#---------------------------------------------------------------------------
@@ -110,7 +114,7 @@ replace_rules __PHONESCAM_859_204
# 833-379-0781 843-200-1039
# 859-222-1162 865-283-4987
#---------------------------------------------------------------------------
-body __PHONESCAM_MISC /(?:\+?<I><PSEP>)?(?:\(?8<O><I>\)?<PSEP>(?:3<O>6<PSEP>95<I>2|346<PSEP>6<O>88)|\(?8<O>2\)?<PSEP>(?:2<I><O><PSEP>7436|346<PSEP>3<I>53)|\(?8<O>3\)?<PSEP>2<I><O><PSEP>5<O>63|\(?8<O>5\)?<PSEP>5<O>7<PSEP>38<O>4|\(?833\)?<PSEP>379<PSEP><O>78<I>|\(?843\)?<PSEP>2<O><O><PSEP><I><O>39|\(?859\)?<PSEP>222<PSEP><I><I>62|\(?865\)?<PSEP>283<PSEP>4987)/
+body __PHONESCAM_MISC /(?:\+?<1><PSEP>)?(?:\(?<8><0><1>\)?<PSEP>(?:<3><0><6><PSEP><9><5><1><2>|<3><4><6><PSEP><6><0><8><8>)|\(?<8><0><2>\)?<PSEP>(?:<2><1><0><PSEP><7><4><3><6>|<3><4><6><PSEP><3><1><5><3>)|\(?<8><0><3>\)?<PSEP><2><1><0><PSEP><5><0><6><3>|\(?<8><0><5>\)?<PSEP><5><0><7><PSEP><3><8><0><4>|\(?<8><3><3>\)?<PSEP><3><7><9><PSEP><0><7><8><1>|\(?<8><4><3>\)?<PSEP><2><0><0><PSEP><1><0><3><9>|\(?<8><5><9>\)?<PSEP><2><2><2><PSEP><1><1><6><2>|\(?<8><6><5>\)?<PSEP><2><8><3><PSEP><4><9><8><7>)/
replace_rules __PHONESCAM_MISC
else # Mail::SpamAssassin::Plugin::ReplaceTags not available -- plain fallbacks
@@ -148,7 +152,7 @@ score PHONE_ORDERSCAM 2.500 # limit
describe PHONE_ORDERSCAM Body contains known order/payment confirmation scam phone number
tflags PHONE_ORDERSCAM publish
-meta PHONE_983_NOVEL __PHONESCAM_983_NOVEL
+meta PHONE_983_NOVEL __PHONESCAM_983_NOVEL && !__NO_EXTERNALS
score PHONE_983_NOVEL 1.500 # limit
describe PHONE_983_NOVEL Body contains phone number in unassigned NANP area code 983
tflags PHONE_983_NOVEL publish
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.