svn commit: r1932938 - spamassassin/trunk/rulesrc/sandbox/jhardin

[email protected]
Newsgroups gmane.mail.spam.spamassassin.cvs
Message-ID <177579219739.1233245.9256952537298138996@svn03-he-fi> 
Author: jhardin
Date: Fri Apr 10 03:36:37 2026
New Revision: 1932938

Log:
Add another phone scam number, work around replacetags "falsy" bug

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Fri Apr 10 03:34:56 2026	(r1932937)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Fri Apr 10 03:36:37 2026	(r1932938)
@@ -4,7 +4,7 @@
 # Phone numbers appearing in order/payment confirmation scam spam
 # ("call our support if this was not you" -- the call is the goal)
 #
-# Generated: 2026-04-08 18:05:25 PDT
+# Generated: 2026-04-09 20:31:17 PDT
 #
 # Optionally uses Mail::SpamAssassin::Plugin::ReplaceTags for digit/separator
 # obfuscation coverage.  If the plugin is not available, plain-regex fallbacks
@@ -20,7 +20,8 @@
 #   misc          Various singletons from the above campaigns
 #
 # Digit obfuscation (ReplaceTags branch):
-#   <0>..<9> from 25_replace.cf cover each digit and its unicode lookalikes
+#   <ZERO> (renamed from <0> to avoid Perl "0" falsiness bug; SA bug 8385) and <1>..<9>
+#   from 25_replace.cf cover each digit and its unicode lookalikes
 #
 # Digit obfuscation (plain branch):
 #   [0oO] for digit 0 / letter O
@@ -61,49 +62,49 @@ body __PHONESCAM_983_ANY  /(?<![0-9=])(?
 replace_rules __PHONESCAM_983_ANY
 
 # Observed: exchange 220, subscriber 2061 2081 2086 2158 2169 2356 2386 2407 2418 2512 2513 2531 2548 2552 2571 2586 2588 2623 2632 2795 2848 2853 2857
-body __PHONESCAM_983_220  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><8><3>\)|<9><8><3>)<PSEP><2><2><0><PSEP>(?:<2><0>(?:<6><1>|<8>(?:<1>|<6>))|<2><1>(?:<5><8>|<6><9>)|<2><3>(?:<5><6>|<8><6>)|<2><4>(?:<0><7>|<1><8>)|<2><5>(?:<1>(?:<2>|<3>)|<3><1>|<4><8>|<5><2>|<7><1>|<8>(?:<6>|<8>))|<2><6>(?:<2><3>|<3><2>)|<2><7><9><5>|<2><8>(?:<4><8>|<5>(?:<3>|<7>)))(?![0-9=])/
+body __PHONESCAM_983_220  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><8><3>\)|<9><8><3>)<PSEP><2><2><ZERO><PSEP>(?:<2><ZERO>(?:<6><1>|<8>(?:<1>|<6>))|<2><1>(?:<5><8>|<6><9>)|<2><3>(?:<5><6>|<8><6>)|<2><4>(?:<ZERO><7>|<1><8>)|<2><5>(?:<1>(?:<2>|<3>)|<3><1>|<4><8>|<5><2>|<7><1>|<8>(?:<6>|<8>))|<2><6>(?:<2><3>|<3><2>)|<2><7><9><5>|<2><8>(?:<4><8>|<5>(?:<3>|<7>)))(?![0-9=])/
 replace_rules __PHONESCAM_983_220
 
 #---------------------------------------------------------------------------
 # 970-303-xxxx  (fake PayPal/Apple order confirmations; calendar spam delivery)
-# Observed: 2088 2090 2100 2135 2184 2319 2451 2457 2563 2565 2603 2645
+# Observed: 2088 2090 2100 2135 2184 2319 2451 2457 2563 2565 2603 2645 4343
 #---------------------------------------------------------------------------
-body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><7><0>\)|<9><7><0>)<PSEP><3><0><3><PSEP>(?:<2><0>(?:<8><8>|<9><0>)|<2><1>(?:<0><0>|<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6>(?:<3>|<5>)|<2><6>(?:<0><3>|<4><5>))(?![0-9=])/
+body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><7><ZERO>\)|<9><7><ZERO>)<PSEP><3><ZERO><3><PSEP>(?:<2><ZERO>(?:<8><8>|<9><ZERO>)|<2><1>(?:<ZERO><ZERO>|<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6>(?:<3>|<5>)|<2><6>(?:<ZERO><3>|<4><5>)|<4><3><4><3>)(?![0-9=])/
 replace_rules __PHONESCAM_970_303
 
 #---------------------------------------------------------------------------
 # 865-209-xxxx  (fake Norton LifeLock / Geek Squad renewals)
 # Observed: 0164 0221
 #---------------------------------------------------------------------------
-body __PHONESCAM_865_209  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><6><5>\)|<8><6><5>)<PSEP><2><0><9><PSEP>(?:<0>(?:<1><6><4>|<2><2><1>))(?![0-9=])/
+body __PHONESCAM_865_209  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><6><5>\)|<8><6><5>)<PSEP><2><ZERO><9><PSEP>(?:<ZERO>(?:<1><6><4>|<2><2><1>))(?![0-9=])/
 replace_rules __PHONESCAM_865_209
 
 #---------------------------------------------------------------------------
 # 865-223-xxxx  (fake Norton LifeLock renewals)
 # Observed: 0873 1294
 #---------------------------------------------------------------------------
-body __PHONESCAM_865_223  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><6><5>\)|<8><6><5>)<PSEP><2><2><3><PSEP>(?:<0><8><7><3>|<1><2><9><4>)(?![0-9=])/
+body __PHONESCAM_865_223  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><6><5>\)|<8><6><5>)<PSEP><2><2><3><PSEP>(?:<ZERO><8><7><3>|<1><2><9><4>)(?![0-9=])/
 replace_rules __PHONESCAM_865_223
 
 #---------------------------------------------------------------------------
 # 812-266-xxxx  (fake Microsoft account security alerts)
 # Observed: 1510 1890
 #---------------------------------------------------------------------------
-body __PHONESCAM_812_266  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><1><2>\)|<8><1><2>)<PSEP><2><6><6><PSEP><1>(?:<5><1>|<8><9>)<0>(?![0-9=])/
+body __PHONESCAM_812_266  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><1><2>\)|<8><1><2>)<PSEP><2><6><6><PSEP><1>(?:<5><1>|<8><9>)<ZERO>(?![0-9=])/
 replace_rules __PHONESCAM_812_266
 
 #---------------------------------------------------------------------------
 # 838-209-xxxx  (generic fake invoice; adjacent pool numbers)
 # Observed: 0187 0188
 #---------------------------------------------------------------------------
-body __PHONESCAM_838_209  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><3><8>\)|<8><3><8>)<PSEP><2><0><9><PSEP><0><1><8>(?:<7>|<8>)(?![0-9=])/
+body __PHONESCAM_838_209  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><3><8>\)|<8><3><8>)<PSEP><2><ZERO><9><PSEP><ZERO><1><8>(?:<7>|<8>)(?![0-9=])/
 replace_rules __PHONESCAM_838_209
 
 #---------------------------------------------------------------------------
 # 859-204-xxxx  (Geek Squad fake renewals)
 # Observed: 6980 6984
 #---------------------------------------------------------------------------
-body __PHONESCAM_859_204  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><5><9>\)|<8><5><9>)<PSEP><2><0><4><PSEP><6><9><8>(?:<0>|<4>)(?![0-9=])/
+body __PHONESCAM_859_204  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<8><5><9>\)|<8><5><9>)<PSEP><2><ZERO><4><PSEP><6><9><8>(?:<ZERO>|<4>)(?![0-9=])/
 replace_rules __PHONESCAM_859_204
 
 #---------------------------------------------------------------------------
@@ -114,7 +115,7 @@ replace_rules __PHONESCAM_859_204
 # 833-379-0781  843-200-1039
 # 859-222-1162  865-232-3323  865-283-4987  865-330-4589
 #---------------------------------------------------------------------------
-body __PHONESCAM_MISC  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:(?:\(<8><0><1>\)|<8><0><1>)<PSEP>(?:<3><0><6><PSEP><9><5><1><2>|<3><4><6><PSEP><6><0><8><8>)|(?:\(<8><0><2>\)|<8><0><2>)<PSEP>(?:<2><1><0><PSEP><7><4><3><6>|<3><4><6><PSEP><3><1><5><3>)|(?:\(<8><0><3>\)|<8><0><3>)<PSEP><2><1><0><PSEP><5><0><6><3>|(?:\(<8><0><5>\)|<8><0><5>)<PSEP><5><0><7><PSEP><3><8><0><4>|(?:\(<8><3><3>\)|<8><3><3>)<PSEP><3><7><9><PSEP><0><7><8><1>|(?:\(<8><4><3>\)|<8><4><3>)<PSEP><2><0><0><PSEP><1><0><3><9>|(?:\(<8><5><9>\)|<8><5><9>)<PSEP><2><2><2><PSEP><1><1><6><2>|(?:\(<8><6><5>\)|<8><6><5>)<PSEP>(?:<2><3><2><PSEP><3><3><2><3>|<2><8><3><PSEP><4><9><8><7>|<3><3><0><PSEP><4><5><8><9>))(?![0-9=])/
+body __PHONESCAM_MISC  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:(?:\(<8><ZERO><1>\)|<8><ZERO><1>)<PSEP>(?:<3><ZERO><6><PSEP><9><5><1><2>|<3><4><6><PSEP><6><ZERO><8><8>)|(?:\(<8><ZERO><2>\)|<8><ZERO><2>)<PSEP>(?:<2><1><ZERO><PSEP><7><4><3><6>|<3><4><6><PSEP><3><1><5><3>)|(?:\(<8><ZERO><3>\)|<8><ZERO><3>)<PSEP><2><1><ZERO><PSEP><5><ZERO><6><3>|(?:\(<8><ZERO><5>\)|<8><ZERO><5>)<PSEP><5><ZERO><7><PSEP><3><8><ZERO><4>|(?:\(<8><3><3>\)|<8><3><3>)<PSEP><3><7><9><PSEP><ZERO><7><8><1>|(?:\(<8><4><3>\)|<8><4><3>)<PSEP><2><ZERO><ZERO><PSEP><1><ZERO><3><9>|(?:\(<8><5><9>\)|<8><5><9>)<PSEP><2><2><2><PSEP><1><1><6><2>|(?:\(<8><6><5>\)|<8><6><5>)<PSEP>(?:<2><3><2><PSEP><3><3><2><3>|<2><8><3><PSEP><4><9><8><7>|<3><3><ZERO><PSEP><4><5><8><9>))(?![0-9=])/
 replace_rules __PHONESCAM_MISC
 
 else  # Mail::SpamAssassin::Plugin::ReplaceTags not available -- plain fallbacks
@@ -123,7 +124,7 @@ body __PHONESCAM_983_ANY  /(?<![0-9=])(?
 
 body __PHONESCAM_983_220  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _]?)?(?:\(983\)|983)[-. _]?22[0oO][-. _]?(?:2[0oO]6[1lI|]|2[0oO]8[1lI|]|2[0oO]86|2[1lI|]58|2[1lI|]69|2356|2386|24[0oO]7|24[1lI|]8|25[1lI|][23]|253[1lI|]|2548|2552|257[1lI|]|258[68]|2623|2632|2795|2848|285[37])(?![0-9=])/
 
-body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _]?)?(?:\(97[0oO]\)|97[0oO])[-. _]?3[0oO]3[-. _]?(?:2[0oO](?:88|9[0oO])|2[1lI|](?:[0oO][0oO]|35|84)|23[1lI|]9|245[1lI|]|2457|256[35]|26(?:[0oO]3|45))(?![0-9=])/
+body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _]?)?(?:\(97[0oO]\)|97[0oO])[-. _]?3[0oO]3[-. _]?(?:2[0oO](?:88|9[0oO])|2[1lI|](?:[0oO][0oO]|35|84)|23[1lI|]9|245[1lI|]|2457|256[35]|26(?:[0oO]3|45)|4343)(?![0-9=])/
 
 body __PHONESCAM_865_209  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _]?)?(?:\(865\)|865)[-. _]?2[0oO]9[-. _]?(?:[0oO][1lI|]64|[0oO]22[1lI|])(?![0-9=])/
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.