Re: spams using rb.gy redirector

On Sat, 25 Jul 2026, Matus UHLAR - fantomas wrote:

>> Suggestion:
>>
>>         *  4.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
>>         *      [score: 1.0000]
>>         *  0.5 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
>>         *      [score: 1.0000]
>> 
>> ...boost your BAYES_999 score. A lot.
>
> I have kept scores somehow lower, so I can see what spam goes around.
> So i can keep to report them etc.

Quarantine rather than discard, then. I do that to feed rule development 
as well as my (tiny) masscheck corpus.

> I repeat - every time I send a complaint to address found in ToS of 
> rebrand.ly where the "https://rb.gy/" points to, I get response that the link 
> hasn't been found.

Sigh.

FWIW, if you append ".stats" to the URL you get a status page that 
includes the redirection target. The url can be extracted and that page 
accessed directly.

https://rb.gy/z3impw.stats
redirects to https://app.rebrandly.com/public/links/share?href=rb.gy/z3impw
(note the redirector URL as a query parameter)

That page says the shortener redirects to 
https://trk.dirctpixelflow.com//click/sxs0j1ja

So perhaps a plugin to retrieve the link page, extract the real link, and 
add that to the URIs list?

The stats page is a bunch of javascript, though, so it might not be 
feasible absent some deeper analysis.

> I am now thinking about explicitly banning these links, so the SMTP message 
> says that.

That's probably the best approach. I will throw a subrule into the repo 
for that so that we can see what masscheck says (and you can use it in a 
scored rule).

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  [email protected]                         pgpk -a [email protected]
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Are you a mildly tech-literate politico horrified by the level of
   ignorance demonstrated by lawmakers gearing up to regulate online
   technology they don't even begin to grasp? Cool. Now you have a
   tiny glimpse into a day in the life of a gun owner.   -- Sean Davis
-----------------------------------------------------------------------
  10 days until the 291st anniversary of John Peter Zenger's acquittal