svn commit: r1933809 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Mon May  4 14:13:27 2026
New Revision: 1933809

Log:
add another observed scam phone number

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Mon May  4 13:51:37 2026	(r1933808)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf	Mon May  4 14:13:27 2026	(r1933809)
@@ -4,7 +4,7 @@
 # Phone numbers appearing in order/payment confirmation scam spam
 # ("call our support if this was not you" -- the call is the goal)
 #
-# Generated: 2026-05-01 18:21:00 PDT
+# Generated: 2026-05-04 07:10 PDT
 #
 # Optionally uses Mail::SpamAssassin::Plugin::ReplaceTags for digit/separator
 # obfuscation coverage.  If the plugin is not available, plain-regex fallbacks
@@ -70,9 +70,9 @@ replace_rules __PHONESCAM_983_220
 
 #---------------------------------------------------------------------------
 # 970-303-xxxx  (fake PayPal/Apple order confirmations; calendar spam delivery)
-# Observed: 2088 2090 2100 2135 2184 2319 2451 2457 2563 2565 2603 2604 2645 4343 4451 4453 4466
+# Observed: 2088 2090 2100 2135 2184 2319 2451 2457 2563 2565 2603 2604 2645 4343 4451 4453 4466 4506
 #---------------------------------------------------------------------------
-body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><7><ZERO>\)|<9><7><ZERO>)<PSEP><3><ZERO><3><PSEP>(?:<2><ZERO>(?:<8><8>|<9><ZERO>)|<2><1>(?:<ZERO><ZERO>|<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6>(?:<3>|<5>)|<2><6>(?:<ZERO>(?:<3>|<4>)|<4><5>)|<4>(?:<3><4><3>|<4><5>(?:<1>|<3>)|<4><6><6>))(?![0-9=])/
+body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><7><ZERO>\)|<9><7><ZERO>)<PSEP><3><ZERO><3><PSEP>(?:<2><ZERO>(?:<8><8>|<9><ZERO>)|<2><1>(?:<ZERO><ZERO>|<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6>(?:<3>|<5>)|<2><6>(?:<ZERO>(?:<3>|<4>)|<4><5>)|<4>(?:<3><4><3>|<4><5>(?:<1>|<3>)|<4><6><6>|<5><ZERO><6>))(?![0-9=])/
 replace_rules __PHONESCAM_970_303
 
 #---------------------------------------------------------------------------
@@ -155,7 +155,7 @@ body __PHONESCAM_983_ANY  /(?<![0-9=])(?
 
 body __PHONESCAM_983_220  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(983\)|983)[-. _\/]?22[0oO][-. _\/]?(?:2[0oO]6[1lI|]|2[0oO]8[1lI|]|2[0oO]86|2[1lI|]58|2[1lI|]69|2356|2386|24[0oO]7|24[1lI|]8|25[1lI|][23]|253[1lI|]|2548|2552|257[1lI|]|258[68]|2623|2632|2795|2848|285[37])(?![0-9=])/
 
-body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(97[0oO]\)|97[0oO])[-. _\/]?3[0oO]3[-. _\/]?(?:2[0oO](?:88|9[0oO])|2[1lI|](?:[0oO][0oO]|35|84)|23[1lI|]9|245[1lI|]|2457|256[35]|26(?:[0oO][34]|45)|4(?:343|45[13]|466))(?![0-9=])/
+body __PHONESCAM_970_303  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(97[0oO]\)|97[0oO])[-. _\/]?3[0oO]3[-. _\/]?(?:2[0oO](?:88|9[0oO])|2[1lI|](?:[0oO][0oO]|35|84)|23[1lI|]9|245[1lI|]|2457|256[35]|26(?:[0oO][34]|45)|4(?:343|45[13]|466|5[0oO]6))(?![0-9=])/
 
 body __PHONESCAM_865_209  /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(865\)|865)[-. _\/]?2[0oO]9[-. _\/]?(?:[0oO][1lI|]64|[0oO]22[1lI|])(?![0-9=])/