How to interpret the debug output from Amavis->Spamassassin?

Could please someone explain how Spamassassin build the following strings:

Oct 17 14:00:30 server amavis[29497]: (29497-02) SA dbg: uridnsbl: domain amazonaws.com in skip list, host sns.eu-central-1.amazonaws.com
Oct 17 14:00:30 server amavis[29497]: (29497-02) SA dbg: check: tagrun - tag URIHOSTS is now ready, value: libcurl.so
Oct 17 14:00:30 server amavis[29497]: (29497-02) SA dbg: check: tagrun - tag URIDOMAINS is now ready, value: libcurl.so

on the first line info about host which sent an email. Мне интересно, откуда spamassassin взял следующие две строчки? Как он обнаружил / нашел домен libcurl.so?

Спасибо за любые объяснения!