svn commit: r1933927 - spamassassin/trunk/rulesrc/sandbox/jhardin
[email protected] Fri, 08 May 2026 01:47:10 -0000
| Newsgroups | gmane.mail.spam.spamassassin.cvs |
|---|---|
| Message-ID | <177820483003.4164240.6489061354320564162@svn03-he-fi> |
Author: jhardin
Date: Fri May 8 01:47:09 2026
New Revision: 1933927
Log:
Add another observed scam phone number, broaden obfuscation detection
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf Thu May 7 21:45:55 2026 (r1933926)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_phonescam.cf Fri May 8 01:47:09 2026 (r1933927)
@@ -4,7 +4,7 @@
# Phone numbers appearing in order/payment confirmation scam spam
# ("call our support if this was not you" -- the call is the goal)
#
-# Generated: 2026-05-04 07:10 PDT
+# Generated: 2026-05-07 18:40 PDT
#
# Optionally uses Mail::SpamAssassin::Plugin::ReplaceTags for digit/separator
# obfuscation coverage. If the plugin is not available, plain-regex fallbacks
@@ -43,8 +43,9 @@
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
-replace_tag PSEP [-. _\/\s]?
-replace_tag PSEP_NS [-. _\s]?
+# Allow space-padded punctuation separators (e.g. "228 - 9974"); _NS variant excludes slash (ham: "800/123-4567")
+replace_tag PSEP \s?[-._\/]?\s?
+replace_tag PSEP_NS \s?[-._]?\s?
# D29: any single digit 2-9 with common unicode lookalikes (NANP NXX first-digit)
# <DIGIT> (any digit 0-9) is defined globally in 25_replace.cf
@@ -70,9 +71,9 @@ replace_rules __PHONESCAM_983_220
#---------------------------------------------------------------------------
# 970-303-xxxx (fake PayPal/Apple order confirmations; calendar spam delivery)
-# Observed: 2088 2090 2100 2135 2184 2319 2451 2457 2563 2565 2603 2604 2645 4343 4451 4453 4466 4506
+# Observed: 2088 2090 2100 2135 2184 2319 2451 2457 2563 2565 2603 2604 2645 4343 4451 4453 4466
#---------------------------------------------------------------------------
-body __PHONESCAM_970_303 /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><7><ZERO>\)|<9><7><ZERO>)<PSEP><3><ZERO><3><PSEP>(?:<2><ZERO>(?:<8><8>|<9><ZERO>)|<2><1>(?:<ZERO><ZERO>|<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6>(?:<3>|<5>)|<2><6>(?:<ZERO>(?:<3>|<4>)|<4><5>)|<4>(?:<3><4><3>|<4><5>(?:<1>|<3>)|<4><6><6>|<5><ZERO><6>))(?![0-9=])/
+body __PHONESCAM_970_303 /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:\(<9><7><ZERO>\)|<9><7><ZERO>)<PSEP><3><ZERO><3><PSEP>(?:<2><ZERO>(?:<8><8>|<9><ZERO>)|<2><1>(?:<ZERO><ZERO>|<3><5>|<8><4>)|<2><3><1><9>|<2><4><5>(?:<1>|<7>)|<2><5><6>(?:<3>|<5>)|<2><6>(?:<ZERO>(?:<3>|<4>)|<4><5>)|<4>(?:<3><4><3>|<4><5>(?:<1>|<3>)|<4><6><6>))(?![0-9=])/
replace_rules __PHONESCAM_970_303
#---------------------------------------------------------------------------
@@ -129,12 +130,13 @@ replace_rules __PHONESCAM_856_250
# 801-306-9512 801-346-6088
# 802-210-7436 802-261-3954 802-346-3153
# 803-210-5063 805-507-3804
+# 810-228-9974
# 818-453-1583
# 833-379-0781 838-900-8510 843-200-1039
# 856-308-3260
-# 859-222-1162 865-232-3323 865-283-4987 865-330-4589
+# 859-222-1162 865-232-3323 865-266-4011 865-283-4987 865-330-4589
#---------------------------------------------------------------------------
-body __PHONESCAM_MISC /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:(?:\(<8><ZERO><1>\)|<8><ZERO><1>)<PSEP>(?:<3><ZERO><6><PSEP><9><5><1><2>|<3><4><6><PSEP><6><ZERO><8><8>)|(?:\(<8><ZERO><2>\)|<8><ZERO><2>)<PSEP>(?:<2><1><ZERO><PSEP><7><4><3><6>|<2><6><1><PSEP><3><9><5><4>|<3><4><6><PSEP><3><1><5><3>)|(?:\(<8><ZERO><3>\)|<8><ZERO><3>)<PSEP><2><1><ZERO><PSEP><5><ZERO><6><3>|(?:\(<8><ZERO><5>\)|<8><ZERO><5>)<PSEP><5><ZERO><7><PSEP><3><8><ZERO><4>|(?:\(<8><1><8>\)|<8><1><8>)<PSEP><4><5><3><PSEP><1><5><8><3>|(?:\(<8><3><3>\)|<8><3><3>)<PSEP><3><7><9><PSEP><ZERO><7><8><1>|(?:\(<8><3><8>\)|<8><3><8>)<PSEP><9><ZERO><ZERO><PSEP><8><5><1><ZERO>|(?:\(<8><4><3>\)|<8><4><3>)<PSEP><2><ZERO><ZERO><PSEP><1><ZERO><3><9>|(?:\(<8><5><6>\)|<8><5><6>)<PSEP><3><ZERO><8><PSEP><3><2><6><ZERO>|(?:\(<8><5><9>\)|<
8><5><9>)<PSEP><2><2><2><PSEP><1><1><6><2>|(?:\(<8><6><5>\)|<8><6><5>)<PSEP>(?:<2><3><2><PSEP><3><3><2><3>|<2><8><3><PSEP><4><9><8><7>|<3><3><ZERO><PSEP><4><5><8><9>))(?![0-9=])/
+body __PHONESCAM_MISC /(?<![0-9=])(?![0-9]{10})(?:\+?<1><PSEP>)?(?:(?:\(<8><ZERO><1>\)|<8><ZERO><1>)<PSEP>(?:<3><ZERO><6><PSEP><9><5><1><2>|<3><4><6><PSEP><6><ZERO><8><8>)|(?:\(<8><ZERO><2>\)|<8><ZERO><2>)<PSEP>(?:<2><1><ZERO><PSEP><7><4><3><6>|<2><6><1><PSEP><3><9><5><4>|<3><4><6><PSEP><3><1><5><3>)|(?:\(<8><ZERO><3>\)|<8><ZERO><3>)<PSEP><2><1><ZERO><PSEP><5><ZERO><6><3>|(?:\(<8><ZERO><5>\)|<8><ZERO><5>)<PSEP><5><ZERO><7><PSEP><3><8><ZERO><4>|(?:\(<8><1><ZERO>\)|<8><1><ZERO>)<PSEP><2><2><8><PSEP><9><9><7><4>|(?:\(<8><1><8>\)|<8><1><8>)<PSEP><4><5><3><PSEP><1><5><8><3>|(?:\(<8><3><3>\)|<8><3><3>)<PSEP><3><7><9><PSEP><ZERO><7><8><1>|(?:\(<8><3><8>\)|<8><3><8>)<PSEP><9><ZERO><ZERO><PSEP><8><5><1><ZERO>|(?:\(<8><4><3>\)|<8><4><3>)<PSEP><2><ZERO><ZERO><PSEP><1><ZERO><3><9>|(?:\(<8><5><6>\)|<
8><5><6>)<PSEP><3><ZERO><8><PSEP><3><2><6><ZERO>|(?:\(<8><5><9>\)|<8><5><9>)<PSEP><2><2><2><PSEP><1><1><6><2>|(?:\(<8><6><5>\)|<8><6><5>)<PSEP>(?:<2><3><2><PSEP><3><3><2><3>|<2><6><6><PSEP><4><ZERO>
<1><1>|<2><8><3><PSEP><4><9><8><7>|<3><3><ZERO><PSEP><4><5><8><9>))(?![0-9=])/
replace_rules __PHONESCAM_MISC
#---------------------------------------------------------------------------
@@ -155,7 +157,7 @@ body __PHONESCAM_983_ANY /(?<![0-9=])(?
body __PHONESCAM_983_220 /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(983\)|983)[-. _\/]?22[0oO][-. _\/]?(?:2[0oO]6[1lI|]|2[0oO]8[1lI|]|2[0oO]86|2[1lI|]58|2[1lI|]69|2356|2386|24[0oO]7|24[1lI|]8|25[1lI|][23]|253[1lI|]|2548|2552|257[1lI|]|258[68]|2623|2632|2795|2848|285[37])(?![0-9=])/
-body __PHONESCAM_970_303 /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(97[0oO]\)|97[0oO])[-. _\/]?3[0oO]3[-. _\/]?(?:2[0oO](?:88|9[0oO])|2[1lI|](?:[0oO][0oO]|35|84)|23[1lI|]9|245[1lI|]|2457|256[35]|26(?:[0oO][34]|45)|4(?:343|45[13]|466|5[0oO]6))(?![0-9=])/
+body __PHONESCAM_970_303 /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(97[0oO]\)|97[0oO])[-. _\/]?3[0oO]3[-. _\/]?(?:2[0oO](?:88|9[0oO])|2[1lI|](?:[0oO][0oO]|35|84)|23[1lI|]9|245[1lI|]|2457|256[35]|26(?:[0oO][34]|45)|4(?:343|45[13]|466))(?![0-9=])/
body __PHONESCAM_865_209 /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(865\)|865)[-. _\/]?2[0oO]9[-. _\/]?(?:[0oO][1lI|]64|[0oO]22[1lI|])(?![0-9=])/
@@ -171,7 +173,7 @@ body __PHONESCAM_856_250 /(?<![0-9=])(?
body __PHONESCAM_859_204 /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:\(859\)|859)[-. _\/]?2[0oO]4[-. _\/]?(?:698[0oO]|6984)(?![0-9=])/
-body __PHONESCAM_MISC /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:(?:\(8[0oO][1lI|]\)|8[0oO][1lI|])[-. _\/]?(?:3[0oO]6[-. _\/]?95[1lI|]2|346[-. _\/]?6[0oO]88)|(?:\(8[0oO]2\)|8[0oO]2)[-. _\/]?(?:2[1lI|][0oO][-. _\/]?7436|26[1lI|][-. _\/]?3954|346[-. _\/]?3[1lI|]53)|(?:\(8[0oO]3\)|8[0oO]3)[-. _\/]?2[1lI|][0oO][-. _\/]?5[0oO]63|(?:\(8[0oO]5\)|8[0oO]5)[-. _\/]?5[0oO]7[-. _\/]?38[0oO]4|(?:\(8[1lI|]8\)|8[1lI|]8)[-. _\/]?453[-. _\/]?[1lI|]583|(?:\(833\)|833)[-. _\/]?379[-. _\/]?[0oO]78[1lI|]|(?:\(838\)|838)[-. _\/]?9[0oO][0oO][-. _\/]?85[1lI|][0oO]|(?:\(843\)|843)[-. _\/]?2[0oO][0oO][-. _\/]?[1lI|][0oO]39|(?:\(856\)|856)[-. _\/]?3[0oO]8[-. _\/]?326[0oO]|(?:\(859\)|859)[-. _\/]?222[-. _\/]?[1lI|][1lI|]62|(?:\(865\)|865)[-. _\/]?(?:232[-. _\/]?3323|283[-. _\/]?4987|33[0oO][-. _\/]?4589))(?
![0-9=])/
+body __PHONESCAM_MISC /(?<![0-9=])(?![0-9]{10})(?:\+?[1lI|][-. _\/]?)?(?:(?:\(8[0oO][1lI|]\)|8[0oO][1lI|])[-. _\/]?(?:3[0oO]6[-. _\/]?95[1lI|]2|346[-. _\/]?6[0oO]88)|(?:\(8[0oO]2\)|8[0oO]2)[-. _\/]?(?:2[1lI|][0oO][-. _\/]?7436|26[1lI|][-. _\/]?3954|346[-. _\/]?3[1lI|]53)|(?:\(8[0oO]3\)|8[0oO]3)[-. _\/]?2[1lI|][0oO][-. _\/]?5[0oO]63|(?:\(8[0oO]5\)|8[0oO]5)[-. _\/]?5[0oO]7[-. _\/]?38[0oO]4|(?:\(8[1lI|][0oO]\)|8[1lI|][0oO])[-. _\/]?228[-. _\/]?9974|(?:\(8[1lI|]8\)|8[1lI|]8)[-. _\/]?453[-. _\/]?[1lI|]583|(?:\(833\)|833)[-. _\/]?379[-. _\/]?[0oO]78[1lI|]|(?:\(838\)|838)[-. _\/]?9[0oO][0oO][-. _\/]?85[1lI|][0oO]|(?:\(843\)|843)[-. _\/]?2[0oO][0oO][-. _\/]?[1lI|][0oO]39|(?:\(856\)|856)[-. _\/]?3[0oO]8[-. _\/]?326[0oO]|(?:\(859\)|859)[-. _\/]?222[-. _\/]?[1lI|][1lI|]62|(?:\(865\)|865)[-. _\/]?(?
:232[-. _\/]?3323|266[-. _\/]?4[0oO][1lI|][1lI|]|283[-. _\/]?4987|33[0oO][-. _\/]?4589))(?![0-9=])/
endif # Mail::SpamAssassin::Plugin::ReplaceTags