Spam email images

[Duncan Rounding]

I am getting a lot of spam recently for drugs etc. (as are many other I presume) with an image in the email (being the spam message) and then some other text to fool the spam detection.

Looking at the source I see this type of thing:
<img alt="" src="cid:1763EB57D1CC2EB5DE1@icecourses.com" height="237"
width="755">
or
<img src="cidict.gif@615A9D44.173CFA42" border="0">
or
<IMG alt="detail" hspace=0
src="cid:000401c6ff20$4ae3b070$ee2307c8@240466DARIUS" align=baseline
border=0>

What is this type of image source? How does an image reference like that work?

[jont]

Aye - nasty and persistent little blighters - as for the image type they are embedded images see http://www.aspemail.com/manual_04.html

[completerookie]

consider passing the emails you receive through something like SpamAssasin.
this will look at the format of the emails and put messages within the header of the emails saying things like:

 2.9 MSGID_MULTIPLE_AT      Message-ID contains multiple '@' characters
 1.4 RCVD_NUMERIC_HELO      Received: contains an IP address used for HELO
 0.0 UNPARSEABLE_RELAY      Informational: message has unparseable relay lines
 0.6 HTML_90_100            BODY: Message is 90% to 100% HTML
 1.7 MIME_HTML_MOSTLY       BODY: Multipart message mostly text/html MIME
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.4 MPART_ALT_DIFF         BODY: HTML and text parts are different
 2.6 HTML_TINY_FONT         RAW: body contains 1 or 0-point font
 0.2 SARE_HTML_FSIZE_1ALL   RAW: BAD STYLE: font(?:-size) too small
 0.2 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76 chars
 1.7 SARE_GIF_STOX          Inline Gif with little HTML

the last one says your email contains very little html and has an inline GIF - indicating that it may well be spam
Your email programme (outlook etc) can then test for these sorts of phrases.

although the spam does get through, you stand a chance of trapping 90%+ of the spam tricks they employ.