Skip to content

urly.fi (cloudflare) always returning 404 #14

Description

@hb9eue

Hi, very usefull module.

At the moment I come acress a lot of spam using Cloudflare's shortener urly.fi

Esample from a spam mail: https://urly.fi/1cAF

When accessed manually thought openssl I get a result:

$ openssl s_client -connect urly.fi:443 -servername urly.fi
[...]
GET /1cAF HTTP/1.0
Host: urly.fi

HTTP/1.1 301 MOVED PERMANENTLY
Date: Fri, 17 May 2019 13:40:58 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Set-Cookie: __cfduid=d2d87edbcdde7c2e41c88b24941f433d01558100458; expires=Sat, 16-May-20 13:40:58 GMT; path=/; domain=.urly.fi; HttpOnly
Location: https://besthotvalentines.com/qjqumernhzkmksy?t=goam
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 4d8601770ad0cc36-ZRH

But when I look at the debug output of SpamAssassin firing this module:

May 17 15:54:17.940 [11506] dbg: DecodeShortURLs: URL is not redirect: https://urly.fi/1cAF = 403 Forbidden

So I wonder where this 403 forbidden comes from. Does CloudFlare recognize the 'LWP' User agent and distrusts it? Is it a https problem?

-Benoît-

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions