Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - How do you stop src="cid:000c01c64d71$97a
  FAQ FAQ  Forum Search   Register Register  Login Login

How do you stop src="cid:000c01c64d71$97a
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
Anonymous View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Anonymous Quote  Post ReplyReply Direct Link To This Post Topic: How do you stop src="cid:000c01c64d71$97a
    Posted: 23 March 2006 at 6:30pm

How do you stop email with

src="cid:000c01c64d71$97a34260$ae2f0245@ddlnjv"  attachments.

obviously numbers differ each time?

can this be stopped using file attachment filter?? i mean how is

this image attached to HTML email in first place?

is above a URL os a hosted image?

Much Appreciated any hint or solution.

A.

 
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 23 March 2006 at 7:00pm

It's a reference to another MIME section of a multipart/related section.

I use something like: ((?i)img alt="".*src="cid\:)

However, it can be overly agressive so watch it!
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com
Back to Top
Anonymous View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Anonymous Quote  Post ReplyReply Direct Link To This Post Posted: 23 March 2006 at 8:31pm

Thank you Desperado for help, i added your RegEx and will monitor...kind regards

 
Back to Top
mikek View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 February 2005
Location: Switzerland
Status: Offline
Points: 133 		Post Options Post Options   Thanks (0) Thanks(0)   Quote mikek Quote  Post ReplyReply Direct Link To This Post Posted: 24 March 2006 at 2:46am

I've had similar Regexes in my keyword list in the past, but they are indeed too agressive.

Since we can't stop anybody using Outlook to compose their mail in HTML or even worse with Word as the editor, you will always be blocking mails of those users with embedded images...

I especially encountered problems with users using graphical signatures and had to remove the keyword again.

If anybody knows how to block mails containing nothing else that an image included by cid:, they would really make my day!

Cheers,

Mike
Back to Top
Altras View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Altras Quote  Post ReplyReply Direct Link To This Post Posted: 09 April 2006 at 12:20am

i found RegEx filter that Desperado posted

((?i)img alt="".*src="cid\:)

blocked images and all blocked items were 100% +ve

I wrote other RegEx and also found it was too aggressive.

However when it stopped, it stopped many many spam. So i know

a large number of this CID images are still being delivered to users :(

thanks!
Back to Top
Desperado View Drop Down
Senior Member
Senior Member
Avatar

Joined: 27 January 2005
Location: United States
Status: Offline
Points: 1143 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Desperado Quote  Post ReplyReply Direct Link To This Post Posted: 09 April 2006 at 1:11am

Please note that SpamFilter now scans images for "Spam Signatures"  I have been testing this version and it really works well.
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.250 seconds.

Copyright (c)2002-2025 LogSat Software LLC - Sales: sales@LogSat.com
Contact Us