Re: spams using rb.gy redirector

Isn't that what https://github.com/smfreegard/DecodeShortURLs
does?

You'd just need to add the shortener to DecodeShortURLs.cf

Or does this no longer work with newer versions of SA?

On Sat, 25 Jul 2026, John Hardin wrote:

> On Sat, 25 Jul 2026, Matus UHLAR - fantomas wrote:
>
>> >  Suggestion:
>> > 
>> >          *  4.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
>> >          *      [score: 1.0000]
>> >          *  0.5 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
>> >          *      [score: 1.0000]
>> > 
>> >  ...boost your BAYES_999 score. A lot.
>>
>>  I have kept scores somehow lower, so I can see what spam goes around.
>>  So i can keep to report them etc.
>
> Quarantine rather than discard, then. I do that to feed rule development as 
> well as my (tiny) masscheck corpus.
>
>>  I repeat - every time I send a complaint to address found in ToS of
>>  rebrand.ly where the "https://rb.gy/" points to, I get response that the
>>  link hasn't been found.
>
> Sigh.
>
> FWIW, if you append ".stats" to the URL you get a status page that includes 
> the redirection target. The url can be extracted and that page accessed 
> directly.
>
> https://rb.gy/z3impw.stats
> redirects to https://app.rebrandly.com/public/links/share?href=rb.gy/z3impw
> (note the redirector URL as a query parameter)
>
> That page says the shortener redirects to 
> https://trk.dirctpixelflow.com//click/sxs0j1ja
>
> So perhaps a plugin to retrieve the link page, extract the real link, and add 
> that to the URIs list?
>
> The stats page is a bunch of javascript, though, so it might not be feasible 
> absent some deeper analysis.
>
>>  I am now thinking about explicitly banning these links, so the SMTP
>>  message says that.
>
> That's probably the best approach. I will throw a subrule into the repo for 
> that so that we can see what masscheck says (and you can use it in a scored 
> rule).
>
>

-- 
Public key #7BBC68D9 at            |                 Shane Williams
http://pgp.mit.edu/                |      System Admin - UT CompSci
=----------------------------------+-------------------------------
All syllogisms contain three lines |              [email protected]
Therefore this is not a syllogism  | www.ischool.utexas.edu/~shanew