Hexamail Guard Administration Guide - SPAM Blocking - detection - Content - Images

Images

There is an overview of the SPAM Blocking process here.

Images

   Images

Embedded Screen Images
When a large image is detected forming the majority of the body of the email, the email will be designated as SPAM. This trick is often used by spam to avoid having any identifiable textual content in their email. Both single large images and multiple small images tiled to make up a large image are blocked. Almost certainly a good indication of spam!
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Weight
Image Maps
When an image map is detected forming the majority of the body of the email, the email will be designated as spam. This trick is often used by spam to avoid having any identifiable textual content in their email. Image maps are very very rarely used by legitimate email.
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Weight
Attached Screen Images
When a large image is detected forming the majority of the body of the email, the email will be designated as spam. This trick is often used by spam to avoid having any identifiable textual content in their email. Both single large images and multiple small images tiled to make up a large image are blocked. Almost certainly a good indication of spam!
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Block
Incorrect Types
When an image is detected with the wrong type specified for its extenion or content type this rule is triggered. Almost certainly a good indication of spam!
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Block
PNG, no content
When a png attached image is detected and there is no content whatsoever this rule is triggered. Almost certainly a good indication of spam!
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Block
GIF, no content
When a gif attached image is detected and there is no content whatsoever this rule is triggered. Almost certainly a good indication of spam!
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Block
JPG, no content
When a jpg attached image is detected and there is no content whatsoever this rule is triggered. Mostly a good indication of spam!
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Weight
RTF, no content
When an rtf file is attached and there is no content whatsoever this rule is triggered. Mostly a good indication of spam!
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Weight
Web Bugs
This rule identifies email where a small image used to track receipt of the email is found. These webbugs are often found in SPAM and very rarely in other mail shots and email marketing, but never in 'normal' email
Example interface

(More Info)Off, Weight, Mark, Block, Delete
Weight
Hosted images
This list allows the configuration of image hosting service matching expressions. When an expression matches it will perform the action specified for the expression. The expression type shows the type of expression the matching engine will use for the entered expression. Expressions have a built in precedence: Allow > Delete > Block > Mark > Weight Remember that your SPAM Blocker/Action settings may globally preclude one or more of these actions.
Case insensitive substring
simply "match" or "sub(match)"
sub(mail) matches the phrase "Hexamail produces server software"
Case sensitive substring
"SUB(match)"
SUB(mail) does not match the phrase "HexaMail produces server software"
Case insensitive exact match
"cmp(match)"
cmp(mail) matches ONLY the entire exact string "mAil"
Case sensitive exact match
"CMP(match)"
CMP(mail) matches ONLY the entire exact string "mail"
Case insensitive word match
" match " or "word(match)"
word(mail) does not match the phrase "Hexamail produces server software" but does match the phrase "Hexamail produces mail server software"
Case sensitive word match
"WORD(match)"
WORD(Mail) does not match the phrase "Hexamail produces mail server software" but does match the phrase "Mail server software produced by Hexamail"
Case insensitive wild match
"*m?tch*" or "wild(*m?tch*)" (? - single character match, * - multiple character match)
Example wild(*v?agra*) matches the phrase "Hexamail does not ship v1agra"
the * wrappers round wildcard expressions, you can also do wild(Start*) to match the phrase "Start of the content" but not match "the content starts here"
Case sensitive wild match
"WILD(m?tch)"
WILD(*v?agra*) does not match the phrase "Hexamail does not ship V1agra"
the * wrappers round wildcard expressions, you can also do WILD(*End) to match the phrase "The content End" but not match "the content ends here"
Regular expression
"reg(expression)"
can be found at the website
http://www.regular-expressions.info/
Case sensitive regular expression
"REG(expression)"
can be found at the website
http://www.regular-expressions.info/
Boolean expression
"BOOL(expression)"
BOOL(wild(*viagra*) AND wild(*ph?rm?cy*) must match both wild matches to be considered an overall match. Brackets may be used.
Brackets allow nested clauses in a BOOL expression
 - If matched these expressions allow the email
 - If matched these expressions add weight to the email score
 - If matched these expressions mark the email
 - If matched these expressions block the email
 - If matched these expressions delete the email
(Click the heading to sort by the column)
Expression
The expression
Action
Action the expression has
Type
Type of expression
(Underneath control)
Add an expression
Test a phrase against the expressions
Edit the selected expression
Delete the selected expression(s)
Import expressions from a file
Export the selected expressions to a file
(Right click selected items)