Print Page | Close Window

How do you stop src="cid:000c01c64d71$97a

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5556
Printed Date: 23 November 2025 at 4:44pm


Topic: How do you stop src="cid:000c01c64d71$97a
Posted By: Guests
Subject: How do you stop src="cid:000c01c64d71$97a
Date Posted: 23 March 2006 at 6:30pm

How do you stop email with

src="cid:000c01c64d71$97a34260$ae2f0245@ddlnjv"  attachments.

obviously numbers differ each time?

can this be stopped using file attachment filter?? i mean how is

this image attached to HTML email in first place?

is above a URL os a hosted image?

Much Appreciated any hint or solution.

A.

 


Replies:
Posted By: Desperado
Date Posted: 23 March 2006 at 7:00pm

It's a reference to another MIME section of a multipart/related section.

I use something like: ((?i)img alt="".*src="cid\:)

However, it can be overly agressive so watch it!



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: Guests
Date Posted: 23 March 2006 at 8:31pm

Thank you Desperado for help, i added your RegEx and will monitor...kind regards

 

Posted By: mikek
Date Posted: 24 March 2006 at 2:46am

I've had similar Regexes in my keyword list in the past, but they are indeed too agressive.

Since we can't stop anybody using Outlook to compose their mail in HTML or even worse with Word as the editor, you will always be blocking mails of those users with embedded images...

I especially encountered problems with users using graphical signatures and had to remove the keyword again.

If anybody knows how to block mails containing nothing else that an image included by cid:, they would really make my day!

Cheers,

Mike

Posted By: Guests
Date Posted: 09 April 2006 at 12:20am

i found RegEx filter that Desperado posted

((?i)img alt="".*src="cid\:)

blocked images and all blocked items were 100% +ve

I wrote other RegEx and also found it was too aggressive.

However when it stopped, it stopped many many spam. So i know

a large number of this CID images are still being delivered to users :(

thanks!

Posted By: Desperado
Date Posted: 09 April 2006 at 1:11am

Please note that SpamFilter now scans images for "Spam Signatures"  I have been testing this version and it really works well.



-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com


Print Page | Close Window