svn commit: r1933250 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Wed Apr 22 14:42:24 2026
New Revision: 1933250

Log:
phone number obfu FP tuning

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Wed Apr 22 14:13:44 2026	(r1933249)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Wed Apr 22 14:42:24 2026	(r1933250)
@@ -4,7 +4,7 @@
 # Phone numbers appearing in order/payment confirmation scam spam
 # ("call our support if this was not you" -- the call is the goal)
 #
-# Generated: 2026-04-19 10:56:57 PDT
+# Generated: 2026-04-22 07:27:49 PDT
 #
 # Optionally uses Mail::SpamAssassin::Plugin::ReplaceTags for digit/separator
 # obfuscation coverage.  If the plugin is not available, plain-regex fallbacks
@@ -133,8 +133,10 @@ replace_rules __PHONESCAM_MISC
 # Lookbehind excludes matches mid-word (e.g. "call 904-xxx" where 'l' is <1>).
 # Negative lookahead excludes clean plain-ASCII numbers so only obfuscated
 # forms (letter substitutions, unicode variants, odd separators) fire.
+# Lookahead uses [1lI|]? for the optional country code to match all <1>
+# substitutes (e.g. "| 555.555.1212" where '|' is a formatting character).
 #---------------------------------------------------------------------------
-body __PHONE_NANP_OBFU  /(?<![0-9=a-zA-Z])(?![0-9a-zA-Z]{9,})(?!\+?1?[-. ]?(?:\([2-9]\d\d\)|[2-9]\d\d)[-. ]?[2-9]\d\d[-. ]?\d{4})(?:\+?<1><PSEP>)?(?:\(<D29><DIGIT><DIGIT>\)|<D29><DIGIT><DIGIT>)<PSEP><D29><DIGIT><DIGIT><PSEP><DIGIT>{4}(?![0-9=])/
+body __PHONE_NANP_OBFU  /(?<![0-9=a-zA-Z])(?![0-9a-zA-Z]{9,})(?!\+?[1lI|]?[-. _\s]?(?:\([2-9]\d\d\)|[2-9]\d\d)[-. ]?[2-9]\d\d[-. ]?\d{4})(?:\+?<1><PSEP>)?(?:\(<D29><DIGIT><DIGIT>\)|<D29><DIGIT><DIGIT>)<PSEP><D29><DIGIT><DIGIT><PSEP><DIGIT>{4}(?![0-9=])/
 replace_rules __PHONE_NANP_OBFU
 
 else  # Mail::SpamAssassin::Plugin::ReplaceTags not available -- plain fallbacks