Re: spams using rb.gy redirector

On 27.07.26 09:47, [email protected] wrote:
>Isn't that what https://github.com/smfreegard/DecodeShortURLs
>does?
>
>You'd just need to add the shortener to DecodeShortURLs.cf
>
>Or does this no longer work with newer versions of SA?

I think it only supports plain redirectors, while rb.gy sends javascript 
code that does the redirect, just look at the output:

curl --max-redirs 0 https://rb.gy/6x9cfg

...seems they did block short URL mentioned below.

>On Sat, 25 Jul 2026, John Hardin wrote:
>
>>On Sat, 25 Jul 2026, Matus UHLAR - fantomas wrote:
>>
>>>>  Suggestion:
>>>> >          *  4.0 BAYES_99 BODY: Bayes spam probability is 99 to 
>>>100%
>>>>          *      [score: 1.0000]
>>>>          *  0.5 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
>>>>          *      [score: 1.0000]
>>>> >  ...boost your BAYES_999 score. A lot.
>>>
>>> I have kept scores somehow lower, so I can see what spam goes around.
>>> So i can keep to report them etc.
>>
>>Quarantine rather than discard, then. I do that to feed rule 
>>development as well as my (tiny) masscheck corpus.
>>
>>> I repeat - every time I send a complaint to address found in ToS of
>>> rebrand.ly where the "https://rb.gy/" points to, I get response that the
>>> link hasn't been found.
>>
>>Sigh.
>>
>>FWIW, if you append ".stats" to the URL you get a status page that 
>>includes the redirection target. The url can be extracted and that 
>>page accessed directly.
>>
>>https://rb.gy/z3impw.stats
>>redirects to https://app.rebrandly.com/public/links/share?href=rb.gy/z3impw
>>(note the redirector URL as a query parameter)
>>
>>That page says the shortener redirects to 
>>https://trk.dirctpixelflow.com//click/sxs0j1ja
>>
>>So perhaps a plugin to retrieve the link page, extract the real 
>>link, and add that to the URIs list?
>>
>>The stats page is a bunch of javascript, though, so it might not be 
>>feasible absent some deeper analysis.
>>
>>> I am now thinking about explicitly banning these links, so the SMTP
>>> message says that.
>>
>>That's probably the best approach. I will throw a subrule into the 
>>repo for that so that we can see what masscheck says (and you can 
>>use it in a scored rule).
-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux IS user friendly, it's just selective who its friends are...