Could please someone explain how Spamassassin build the following strings:
Oct 17 14:00:30 server amavis[29497]: (29497-02) SA dbg: uridnsbl: domain amazonaws.com in skip list, host sns.eu-central-1.amazonaws.com
Oct 17 14:00:30 server amavis[29497]: (29497-02) SA dbg: check: tagrun - tag URIHOSTS is now ready, value: libcurl.so
Oct 17 14:00:30 server amavis[29497]: (29497-02) SA dbg: check: tagrun - tag URIDOMAINS is now ready, value: libcurl.so
on the first line info about host which sent an email. For me is interesting where did the spamassassin get the next two lines? How he detected/found domain libcurl.so?
Thank you for any explanation!