svn commit: r1932464 - spamassassin/trunk/rulesrc/sandbox/jhardin

[email protected]
Newsgroups gmane.mail.spam.spamassassin.cvs
Message-ID <177419986348.2306998.14731734743148497113@svn03-he-fi> 
Author: jhardin
Date: Sun Mar 22 17:17:43 2026
New Revision: 1932464

Log:
Phone number FP reduction

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Sun Mar 22 16:20:21 2026	(r1932463)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Sun Mar 22 17:17:43 2026	(r1932464)
@@ -4,7 +4,7 @@
 # Phone numbers appearing in order/payment confirmation scam spam
 # ("call our support if this was not you" -- the call is the goal)
 #
-# Generated: 2026-03-20 19:15:52 PDT
+# Generated: 2026-03-22 10:07:15 PDT
 #
 # Optionally uses Mail::SpamAssassin::Plugin::ReplaceTags for digit/separator
 # obfuscation coverage.  If the plugin is not available, plain-regex fallbacks
@@ -29,7 +29,7 @@
 #
 # Separator obfuscation (PSEP):
 #   One optional character between digit groups: -, ., space, underscore.
-#   Area code parens handled separately with \(?...\)?.
+#   Area code parens: both-or-none match (?:\(AC\)|AC).
 #   Middle-ground choice: allows common visual separators but not arbitrary strings.
 #
 # Rule structure:
@@ -57,53 +57,53 @@ replace_tag D29   (?:[2-9zZsS]|(?-i:[Ggq
 
 # Matches any syntactically valid NANP number in AC 983.
 # Exchange first digit restricted to [2-9] per NANP rules.
-body __PHONESCAM_983_ANY  /(?:\+?<1><PSEP>)?\(?<9><8><3>\)?<PSEP><D29><DIGIT><DIGIT><PSEP><DIGIT>{4}/
+body __PHONESCAM_983_ANY  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<9><8><3>\)|<9><8><3>)<PSEP><D29><DIGIT><DIGIT><PSEP><DIGIT>{4}(?![0-9=])/
 replace_rules __PHONESCAM_983_ANY
 
 # Observed: exchange 220, subscriber 2061 2081 2086 2158 2169 2356 2386 2407 2418 2512 2513 2531 2548 2552 2571 2586 2588 2623 2632 2795 2848 2853 2857
-body __PHONESCAM_983_220  /(?:\+?<1><PSEP>)?\(?<9><8><3>\)?<PSEP><2><2><0><PSEP>(?:<2><0>(?:<6><1>|<8>(?:<1>|<6>))|<2><1>(?:<5><8>|<6><9>)|<2><3>(?:<5><6>|<8><6>)|<2><4>(?:<0><7>|<1><8>)|<2><5>(?:<1>(?:<2>|<3>)|<3><1>|<4><8>|<5><2>|<7><1>|<8>(?:<6>|<8>))|<2><6>(?:<2><3>|<3><2>)|<2><7><9><5>|<2><8>(?:<4><8>|<5>(?:<3>|<7>)))/
+body __PHONESCAM_983_220  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<9><8><3>\)|<9><8><3>)<PSEP><2><2><0><PSEP>(?:<2><0>(?:<6><1>|<8>(?:<1>|<6>))|<2><1>(?:<5><8>|<6><9>)|<2><3>(?:<5><6>|<8><6>)|<2><4>(?:<0><7>|<1><8>)|<2><5>(?:<1>(?:<2>|<3>)|<3><1>|<4><8>|<5><2>|<7><1>|<8>(?:<6>|<8>))|<2><6>(?:<2><3>|<3><2>)|<2><7><9><5>|<2><8>(?:<4><8>|<5>(?:<3>|<7>)))(?![0-9=])/
 replace_rules __PHONESCAM_983_220
 
 #---------------------------------------------------------------------------
 # 970-303-xxxx  (fake PayPal/Apple order confirmations; calendar spam delivery)
 # Observed: 2135 2184 2319 2451 2457 2563 2645
 #---------------------------------------------------------------------------
-body __PHONESCAM_970_303  /(?:\+?<1><PSEP>)?\(?<9><7><0>\)?<PSEP><3><0><3><PSEP>(?:<2><1>(?:<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6><3>|<2><6><4><5>)/
+body __PHONESCAM_970_303  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<9><7><0>\)|<9><7><0>)<PSEP><3><0><3><PSEP>(?:<2><1>(?:<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6><3>|<2><6><4><5>)(?![0-9=])/
 replace_rules __PHONESCAM_970_303
 
 #---------------------------------------------------------------------------
 # 865-209-xxxx  (fake Norton LifeLock / Geek Squad renewals)
 # Observed: 0164 0221
 #---------------------------------------------------------------------------
-body __PHONESCAM_865_209  /(?:\+?<1><PSEP>)?\(?<8><6><5>\)?<PSEP><2><0><9><PSEP>(?:<0>(?:<1><6><4>|<2><2><1>))/
+body __PHONESCAM_865_209  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<8><6><5>\)|<8><6><5>)<PSEP><2><0><9><PSEP>(?:<0>(?:<1><6><4>|<2><2><1>))(?![0-9=])/
 replace_rules __PHONESCAM_865_209
 
 #---------------------------------------------------------------------------
 # 865-223-xxxx  (fake Norton LifeLock renewals)
 # Observed: 0873 1294
 #---------------------------------------------------------------------------
-body __PHONESCAM_865_223  /(?:\+?<1><PSEP>)?\(?<8><6><5>\)?<PSEP><2><2><3><PSEP>(?:<0><8><7><3>|<1><2><9><4>)/
+body __PHONESCAM_865_223  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<8><6><5>\)|<8><6><5>)<PSEP><2><2><3><PSEP>(?:<0><8><7><3>|<1><2><9><4>)(?![0-9=])/
 replace_rules __PHONESCAM_865_223
 
 #---------------------------------------------------------------------------
 # 812-266-xxxx  (fake Microsoft account security alerts)
 # Observed: 1510 1890
 #---------------------------------------------------------------------------
-body __PHONESCAM_812_266  /(?:\+?<1><PSEP>)?\(?<8><1><2>\)?<PSEP><2><6><6><PSEP><1>(?:<5><1>|<8><9>)<0>/
+body __PHONESCAM_812_266  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<8><1><2>\)|<8><1><2>)<PSEP><2><6><6><PSEP><1>(?:<5><1>|<8><9>)<0>(?![0-9=])/
 replace_rules __PHONESCAM_812_266
 
 #---------------------------------------------------------------------------
 # 838-209-xxxx  (generic fake invoice; adjacent pool numbers)
 # Observed: 0187 0188
 #---------------------------------------------------------------------------
-body __PHONESCAM_838_209  /(?:\+?<1><PSEP>)?\(?<8><3><8>\)?<PSEP><2><0><9><PSEP><0><1><8>(?:<7>|<8>)/
+body __PHONESCAM_838_209  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<8><3><8>\)|<8><3><8>)<PSEP><2><0><9><PSEP><0><1><8>(?:<7>|<8>)(?![0-9=])/
 replace_rules __PHONESCAM_838_209
 
 #---------------------------------------------------------------------------
 # 859-204-xxxx  (Geek Squad fake renewals)
 # Observed: 6980 6984
 #---------------------------------------------------------------------------
-body __PHONESCAM_859_204  /(?:\+?<1><PSEP>)?\(?<8><5><9>\)?<PSEP><2><0><4><PSEP><6><9><8>(?:<0>|<4>)/
+body __PHONESCAM_859_204  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:\(<8><5><9>\)|<8><5><9>)<PSEP><2><0><4><PSEP><6><9><8>(?:<0>|<4>)(?![0-9=])/
 replace_rules __PHONESCAM_859_204
 
 #---------------------------------------------------------------------------
@@ -114,28 +114,28 @@ replace_rules __PHONESCAM_859_204
 # 833-379-0781  843-200-1039
 # 859-222-1162  865-283-4987
 #---------------------------------------------------------------------------
-body __PHONESCAM_MISC  /(?:\+?<1><PSEP>)?(?:\(?<8><0><1>\)?<PSEP>(?:<3><0><6><PSEP><9><5><1><2>|<3><4><6><PSEP><6><0><8><8>)|\(?<8><0><2>\)?<PSEP>(?:<2><1><0><PSEP><7><4><3><6>|<3><4><6><PSEP><3><1><5><3>)|\(?<8><0><3>\)?<PSEP><2><1><0><PSEP><5><0><6><3>|\(?<8><0><5>\)?<PSEP><5><0><7><PSEP><3><8><0><4>|\(?<8><3><3>\)?<PSEP><3><7><9><PSEP><0><7><8><1>|\(?<8><4><3>\)?<PSEP><2><0><0><PSEP><1><0><3><9>|\(?<8><5><9>\)?<PSEP><2><2><2><PSEP><1><1><6><2>|\(?<8><6><5>\)?<PSEP><2><8><3><PSEP><4><9><8><7>)/
+body __PHONESCAM_MISC  /(?<![0-9=])(?:\+?<1><PSEP>)?(?:(?:\(<8><0><1>\)|<8><0><1>)<PSEP>(?:<3><0><6><PSEP><9><5><1><2>|<3><4><6><PSEP><6><0><8><8>)|(?:\(<8><0><2>\)|<8><0><2>)<PSEP>(?:<2><1><0><PSEP><7><4><3><6>|<3><4><6><PSEP><3><1><5><3>)|(?:\(<8><0><3>\)|<8><0><3>)<PSEP><2><1><0><PSEP><5><0><6><3>|(?:\(<8><0><5>\)|<8><0><5>)<PSEP><5><0><7><PSEP><3><8><0><4>|(?:\(<8><3><3>\)|<8><3><3>)<PSEP><3><7><9><PSEP><0><7><8><1>|(?:\(<8><4><3>\)|<8><4><3>)<PSEP><2><0><0><PSEP><1><0><3><9>|(?:\(<8><5><9>\)|<8><5><9>)<PSEP><2><2><2><PSEP><1><1><6><2>|(?:\(<8><6><5>\)|<8><6><5>)<PSEP><2><8><3><PSEP><4><9><8><7>)(?![0-9=])/
 replace_rules __PHONESCAM_MISC
 
 else  # Mail::SpamAssassin::Plugin::ReplaceTags not available -- plain fallbacks
 
-body __PHONESCAM_983_ANY  /(?:\+?[1lI|][-. _]?)?\(?983\)?[-. _]?[2-9]\d\d[-. _]?\d{4}/
+body __PHONESCAM_983_ANY  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(983\)|983)[-. _]?[2-9]\d\d[-. _]?\d{4}(?![0-9=])/
 
-body __PHONESCAM_983_220  /(?:\+?[1lI|][-. _]?)?\(?983\)?[-. _]?22[0oO][-. _]?(?:2[0oO]6[1lI|]|2[0oO]8[1lI|]|2[0oO]86|2[1lI|]58|2[1lI|]69|2356|2386|24[0oO]7|24[1lI|]8|25[1lI|][23]|253[1lI|]|2548|2552|257[1lI|]|258[68]|2623|2632|2795|2848|285[37])/
+body __PHONESCAM_983_220  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(983\)|983)[-. _]?22[0oO][-. _]?(?:2[0oO]6[1lI|]|2[0oO]8[1lI|]|2[0oO]86|2[1lI|]58|2[1lI|]69|2356|2386|24[0oO]7|24[1lI|]8|25[1lI|][23]|253[1lI|]|2548|2552|257[1lI|]|258[68]|2623|2632|2795|2848|285[37])(?![0-9=])/
 
-body __PHONESCAM_970_303  /(?:\+?[1lI|][-. _]?)?\(?97[0oO]\)?[-. _]?3[0oO]3[-. _]?(?:2[1lI|]35|2[1lI|]84|23[1lI|]9|245[1lI|]|2457|2563|2645)/
+body __PHONESCAM_970_303  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(97[0oO]\)|97[0oO])[-. _]?3[0oO]3[-. _]?(?:2[1lI|]35|2[1lI|]84|23[1lI|]9|245[1lI|]|2457|2563|2645)(?![0-9=])/
 
-body __PHONESCAM_865_209  /(?:\+?[1lI|][-. _]?)?\(?865\)?[-. _]?2[0oO]9[-. _]?(?:[0oO][1lI|]64|[0oO]22[1lI|])/
+body __PHONESCAM_865_209  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(865\)|865)[-. _]?2[0oO]9[-. _]?(?:[0oO][1lI|]64|[0oO]22[1lI|])(?![0-9=])/
 
-body __PHONESCAM_865_223  /(?:\+?[1lI|][-. _]?)?\(?865\)?[-. _]?223[-. _]?(?:[0oO]873|[1lI|]294)/
+body __PHONESCAM_865_223  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(865\)|865)[-. _]?223[-. _]?(?:[0oO]873|[1lI|]294)(?![0-9=])/
 
-body __PHONESCAM_812_266  /(?:\+?[1lI|][-. _]?)?\(?8[1lI|]2\)?[-. _]?266[-. _]?(?:[1lI|]5[1lI|][0oO]|[1lI|]89[0oO])/
+body __PHONESCAM_812_266  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(8[1lI|]2\)|8[1lI|]2)[-. _]?266[-. _]?(?:[1lI|]5[1lI|][0oO]|[1lI|]89[0oO])(?![0-9=])/
 
-body __PHONESCAM_838_209  /(?:\+?[1lI|][-. _]?)?\(?838\)?[-. _]?2[0oO]9[-. _]?[0oO][1lI|]8[78]/
+body __PHONESCAM_838_209  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(838\)|838)[-. _]?2[0oO]9[-. _]?[0oO][1lI|]8[78](?![0-9=])/
 
-body __PHONESCAM_859_204  /(?:\+?[1lI|][-. _]?)?\(?859\)?[-. _]?2[0oO]4[-. _]?(?:698[0oO]|6984)/
+body __PHONESCAM_859_204  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:\(859\)|859)[-. _]?2[0oO]4[-. _]?(?:698[0oO]|6984)(?![0-9=])/
 
-body __PHONESCAM_MISC  /(?:\+?[1lI|][-. _]?)?(?:\(?8[0oO][1lI|]\)?[-. _]?(?:3[0oO]6[-. _]?95[1lI|]2|346[-. _]?6[0oO]88)|\(?8[0oO]2\)?[-. _]?(?:2[1lI|][0oO][-. _]?7436|346[-. _]?3[1lI|]53)|\(?8[0oO]3\)?[-. _]?2[1lI|][0oO][-. _]?5[0oO]63|\(?8[0oO]5\)?[-. _]?5[0oO]7[-. _]?38[0oO]4|\(?833\)?[-. _]?379[-. _]?[0oO]78[1lI|]|\(?843\)?[-. _]?2[0oO][0oO][-. _]?[1lI|][0oO]39|\(?859\)?[-. _]?222[-. _]?[1lI|][1lI|]62|\(?865\)?[-. _]?283[-. _]?4987)/
+body __PHONESCAM_MISC  /(?<![0-9=])(?:\+?[1lI|][-. _]?)?(?:(?:\(8[0oO][1lI|]\)|8[0oO][1lI|])[-. _]?(?:3[0oO]6[-. _]?95[1lI|]2|346[-. _]?6[0oO]88)|(?:\(8[0oO]2\)|8[0oO]2)[-. _]?(?:2[1lI|][0oO][-. _]?7436|346[-. _]?3[1lI|]53)|(?:\(8[0oO]3\)|8[0oO]3)[-. _]?2[1lI|][0oO][-. _]?5[0oO]63|(?:\(8[0oO]5\)|8[0oO]5)[-. _]?5[0oO]7[-. _]?38[0oO]4|(?:\(833\)|833)[-. _]?379[-. _]?[0oO]78[1lI|]|(?:\(843\)|843)[-. _]?2[0oO][0oO][-. _]?[1lI|][0oO]39|(?:\(859\)|859)[-. _]?222[-. _]?[1lI|][1lI|]62|(?:\(865\)|865)[-. _]?283[-. _]?4987)(?![0-9=])/
 
 endif  # Mail::SpamAssassin::Plugin::ReplaceTags
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.