[SC-Help] Re: What it is?

[Kenneth Brody]

"Jan M. Nelken" wrote:
> 
> Kenneth Brody wrote:
> > "Jan M. Nelken" wrote:
> >> I am getting series of Penny stock spam into my Lotus Notes in-basket. It
> >> appears that payload is an attached gif which Lotus Notes is "auto-opening" -
> >> but this "auto-open" only happens on this kind of spam.
> >>
> >> In one part I found this term: SRC="cid:OK64699DVVC at texas.net". What does
> >> it mean?
> >
> > That is probably part of an <img> tag, and it means that the image is an
> > attachment to the e-mail.  The "cid:" part identifies the attachment based
> > on the identifier that follows.  I believe that one of the attacments will
> > have something like "Content-ID:" within it which matches the ID.
> >
> > While Lotus may "auto-open" it, you can at least be assured that it is
> > grabbing the image from the e-mail itself, rather than using a "web bug"
> > off the 'net, which may uniquely identify you to the spammer.
> >
> 
> Thanks for the info. I am presuming that "texas.net" of this cid identifier is
> just a part of the string identifier and has nothing to do with texas.net domain
> if such one exists, right?

The "cid" value can be (almost) anything, and anything in it that looks
like a domain name is, in the case of spam, purely coincidental.  In a
real e-mail, the domain name may be added, just as the domain name is
typically added to the "message-id" value.

-- 
+-------------------------+--------------------+-----------------------------+
| Kenneth J. Brody        | www.hvcomputer.com |                             |
| kenbrody/at\spamcop.net | www.fptech.com     | #include <std_disclaimer.h> |
+-------------------------+--------------------+-----------------------------+
Don't e-mail me at: <mailto:ThisIsASpamTrap at gmail.com>