Tracking Pixel / Meta Pixel

This section contains scripts that hMailServer has contributed with. hMailServer 5 is needed to use these.
Post Reply
User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-02 17:15

Been playing with this since yesterday.

eM Client PRO version WILL (allegedly) detect and deal with them - so it says on my free version ;-)

It seems they don't get them all, so ... I'll be running this code for a week or two and see if I can get them all. The intension is to NUKE them. They are inflicting on my privacy ... same with traffic lights, indicator blinks and brake lights ... People don't need to know where I'm going!

Code: Select all

Function MetaPixel(oMessage) : MetaPixel = False
    '
    ' Replace <img[^>]*(height|width)=(3D)?"1(px)?"[^>]*> with NOP
    ' Search  <img[^>]*(height|width)=(?:3D)?"([^(?:px)?"]+)(?:px)?"[^>]*>
    '
    Dim oMatch, oMatchCollection, strRegEx

    If oMessage.HasBodyType("text/html") Then

        strRegEx = "<img[^>]*(height|width)=(?:3D)?""([^(?:px)?""]+)(?:px)?""[^>]*>"
        Set oMatchCollection = oLookup(strRegEx, oMessage.HTMLBody, True)
        For Each oMatch In oMatchCollection
            If oMatch.SubMatches.Count > 0 Then
                If (oMatch.SubMatches(1) = 1) Then MetaPixel = True
            End If
        Next

    End If
End Function

Sub OnAcceptMessage(oClient, oMessage)
'
'    STUFF
'
    '
    '   Detect Meta Pixel
    '
    If (oMessage.HeaderValue("MetaPixel") <> "YES") And MetaPixel(oMessage) Then
        oMessage.Subject = Chr(164) & "  " & oMessage.Subject
        oMessage.HeaderValue("MetaPixel") = "YES"
        oMessage.Save
    End If
'
'    MORE STUFF
'
End Sub
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

User avatar
RvdH
Senior user
Senior user
Posts: 3344
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: Tracking Pixel / Meta Pixel

Post by RvdH » 2023-08-02 18:54

Do mail clients not block images by default?
Outlook and thunderbird do, unless you whitelist/trust the sender of course

Seems a bit of a nothingburger
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-02 19:20

SorenR wrote:
2023-08-02 17:15
Been playing with this since yesterday.

eM Client PRO version WILL (allegedly) detect and deal with them - so it says on my free version ;-)

It seems they don't get them all, so ...
That feature only works with the paid version.

https://forum.emclient.com/t/tracking-p ... sion/83833

But yes, if you do not download any external content, then the pixel will also NOT be downloaded.

In the paid version you have the option of downloading external content while excluding tracking pixel images.

User avatar
RvdH
Senior user
Senior user
Posts: 3344
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: Tracking Pixel / Meta Pixel

Post by RvdH » 2023-08-02 19:51

palinka wrote:
2023-08-02 19:20
SorenR wrote:
2023-08-02 17:15
Been playing with this since yesterday.

eM Client PRO version WILL (allegedly) detect and deal with them - so it says on my free version ;-)

It seems they don't get them all, so ...
That feature only works with the paid version.

https://forum.emclient.com/t/tracking-p ... sion/83833

But yes, if you do not download any external content, then the pixel will also NOT be downloaded.

In the paid version you have the option of downloading external content while excluding tracking pixel images.
Ah OK, never used eMClient

But what if the tracking pixel is 2px by 2px to bypass checks like the one catched in code above, or no dimmensions are given?
Last edited by RvdH on 2023-08-02 19:53, edited 1 time in total.
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-02 19:52

I just looked at a message that gave me the "unsafe content" warning. I'm using the latest emclient pro (9.2.something - paid version). The image is not a pixel. I opened it on my phone. Its a banner as it claims to be.

Code: Select all

--Apple-Mail-2D1515F2-8B2F-4F93-9F51-7F170B073030
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body dir="auto"><div dir="ltr"><br><br><br><br><hr size="0.5" color="#E2E2E2" align="center" width="100%"><div><a href="http://itunes.apple.com/app/id544373562?mt=8"><img width="125" height="38" src="https://ifunplay.com/image/fasterscan_share_banner.png"></a></div></div><div dir="ltr"><br><br></div></body></html>

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-02 19:58

RvdH wrote:
2023-08-02 18:54
Do mail clients not block images by default?
Outlook and thunderbird do, unless you whitelist/trust the sender of course

Seems a bit of a nothingburger
I have my eM Client NOT show "online" pictures by default - until I allow eM Client to download them - and clearly also the tracking pixels.
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-02 20:50

SorenR wrote:
2023-08-02 17:15
Been playing with this since yesterday.

eM Client PRO version WILL (allegedly) detect and deal with them - so it says on my free version ;-)

It seems they don't get them all, so ... I'll be running this code for a week or two and see if I can get them all. The intension is to NUKE them. They are inflicting on my privacy ... same with traffic lights, indicator blinks and brake lights ... People don't need to know where I'm going!

Code: Select all

Function MetaPixel(oMessage) : MetaPixel = False
    '
    ' Replace <img[^>]*(height|width)=(3D)?"1(px)?"[^>]*> with NOP
    ' Search  <img[^>]*(height|width)=(?:3D)?"([^(?:px)?"]+)(?:px)?"[^>]*>
    '
    Dim oMatch, oMatchCollection, strRegEx

    If oMessage.HasBodyType("text/html") Then

        strRegEx = "<img[^>]*(height|width)=(?:3D)?""([^(?:px)?""]+)(?:px)?""[^>]*>"
        Set oMatchCollection = oLookup(strRegEx, oMessage.HTMLBody, True)
        For Each oMatch In oMatchCollection
            If oMatch.SubMatches.Count > 0 Then
                If (oMatch.SubMatches(1) = 1) Then MetaPixel = True
            End If
        Next

    End If
End Function

Sub OnAcceptMessage(oClient, oMessage)
'
'    STUFF
'
    '
    '   Detect Meta Pixel
    '
    If (oMessage.HeaderValue("MetaPixel") <> "YES") And MetaPixel(oMessage) Then
        oMessage.Subject = Chr(164) & "  " & oMessage.Subject
        oMessage.HeaderValue("MetaPixel") = "YES"
        oMessage.Save
    End If
'
'    MORE STUFF
'
End Sub
I found a message with an actual tracking pixel and your regex doesn't work on it. This one did:

Code: Select all

<img[^>]*(height|width)=(3D)?("|')1px("|')[^>]*>
https://regex101.com/r/UU3l5A/1

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-02 22:28

palinka wrote:
2023-08-02 20:50
SorenR wrote:
2023-08-02 17:15
Been playing with this since yesterday.

eM Client PRO version WILL (allegedly) detect and deal with them - so it says on my free version ;-)

It seems they don't get them all, so ... I'll be running this code for a week or two and see if I can get them all. The intension is to NUKE them. They are inflicting on my privacy ... same with traffic lights, indicator blinks and brake lights ... People don't need to know where I'm going!

Code: Select all

Function MetaPixel(oMessage) : MetaPixel = False
    '
    ' Replace <img[^>]*(height|width)=(3D)?"1(px)?"[^>]*> with NOP
    ' Search  <img[^>]*(height|width)=(?:3D)?"([^(?:px)?"]+)(?:px)?"[^>]*>
    '
    Dim oMatch, oMatchCollection, strRegEx

    If oMessage.HasBodyType("text/html") Then

        strRegEx = "<img[^>]*(height|width)=(?:3D)?""([^(?:px)?""]+)(?:px)?""[^>]*>"
        Set oMatchCollection = oLookup(strRegEx, oMessage.HTMLBody, True)
        For Each oMatch In oMatchCollection
            If oMatch.SubMatches.Count > 0 Then
                If (oMatch.SubMatches(1) = 1) Then MetaPixel = True
            End If
        Next

    End If
End Function

Sub OnAcceptMessage(oClient, oMessage)
'
'    STUFF
'
    '
    '   Detect Meta Pixel
    '
    If (oMessage.HeaderValue("MetaPixel") <> "YES") And MetaPixel(oMessage) Then
        oMessage.Subject = Chr(164) & "  " & oMessage.Subject
        oMessage.HeaderValue("MetaPixel") = "YES"
        oMessage.Save
    End If
'
'    MORE STUFF
'
End Sub
I found a message with an actual tracking pixel and your regex doesn't work on it. This one did:

Code: Select all

<img[^>]*(height|width)=(3D)?("|')1px("|')[^>]*>
https://regex101.com/r/UU3l5A/1
You did notice the double quotes for VBScript string handling ??

Code: Select all

strRegEx = "<img[^>]*(height|width)=(?:3D)?" & Chr(34) & "([^(?:px)?" & Chr(34) & "]+)(?:px)?" & Chr(34) & "[^>]*>"
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-02 22:39

SorenR wrote:
2023-08-02 22:28
You did notice the double quotes for VBScript string handling ??
Of course not. :mrgreen:

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-02 22:42

palinka wrote:
2023-08-02 22:39
SorenR wrote:
2023-08-02 22:28
You did notice the double quotes for VBScript string handling ??
Of course not. :mrgreen:
Just tried the "replace" regex with your example ... also works ;-)
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-02 22:59

SorenR wrote:
2023-08-02 22:42
palinka wrote:
2023-08-02 22:39
SorenR wrote:
2023-08-02 22:28
You did notice the double quotes for VBScript string handling ??
Of course not. :mrgreen:
Just tried the "replace" regex with your example ... also works ;-)
I added single quote ("|') because... sometimes... you know.... But it makes everything look weird.

Code: Select all

strRegEx = "<img[^>]*(height|width)=(3D)?(" & Chr(34) & "|" & Chr(39 & ")1px(" & Chr(34) & "|" & Chr(39 & ")[^>]*>"

User avatar
RvdH
Senior user
Senior user
Posts: 3344
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: Tracking Pixel / Meta Pixel

Post by RvdH » 2023-08-03 08:50

palinka wrote:
2023-08-02 22:59
SorenR wrote:
2023-08-02 22:42
palinka wrote:
2023-08-02 22:39


Of course not. :mrgreen:
Just tried the "replace" regex with your example ... also works ;-)
I added single quote ("|') because... sometimes... you know.... But it makes everything look weird.

Code: Select all

strRegEx = "<img[^>]*(height|width)=(3D)?(" & Chr(34) & "|" & Chr(39 & ")1px(" & Chr(34) & "|" & Chr(39 & ")[^>]*>"
↑ defect

Code: Select all

strRegEx = "<img[^>]*(height|width)=(3D)?(" & Chr(34) & "|" & Chr(39) & ")1px(" & Chr(34) & "|" & Chr(39) & ")[^>]*>"
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-04 13:19

Modified the search routine a bit.
Match will only occur if different permutations of the base words {hight="1"}, {width="1"} and {alt=""} all exist - in any order.

My eM Client do not identify all found results as "Tracking pixel has been detected and downloaded. You can block it with PRO version." as my code detects more 1 pixel images. Not entirely sure what I'm missing ?!?

Code: Select all

Function TrackingPixel(oMessage) : TrackingPixel = False
    If oMessage.HasBodyType("text/html") Then
        Dim i, oMatch, oMatchCollection, strRegEx
        i = 0
        strRegEx = "(<img[^>]*(?=.*\bheight=(?:3D)?""1(?:px)?"")(?=.*\bwidth=(?:3D)?""1(?:px)?"")(?=.*\balt=(?:3D)?"""")[^>]*>)"
        Set oMatchCollection = oLookup(strRegEx, oMessage.HTMLBody, True)
        For Each oMatch In oMatchCollection
            TrackingPixel = True
            i = i + 1
            EventLog.Write( "TrackingPixel(" & i & "): " & oMatch.Value )
        Next
        Set oMatch = Nothing
        Set oMatchCollection = Nothing
    End If
End Function

Sub OnDeliverMessage(oMessage)

    '
    '   Detect Tracking Pixel
    '
    If TrackingPixel(oMessage) And (oMessage.HeaderValue("TrackingPixel") <> "YES") Then
        oMessage.Subject = oMessage.Subject & "  " & Chr(164)
        oMessage.HeaderValue("TrackingPixel") = "YES"
        oMessage.Save
    End If
    
End Sub
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-04 15:26

SorenR wrote:
2023-08-04 13:19
My eM Client do not identify all found results as "Tracking pixel has been detected and downloaded. You can block it with PRO version." as my code detects more 1 pixel images. Not entirely sure what I'm missing ?!?
Maybe its not you that's missing something, obviously.

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-04 17:37

Hmm... My code is logging all sorts of crap...

regex101.com and reality do NOT match :roll:

Trying new "formula" eliminating the "\b" thingy.

Code: Select all

strRegEx = "(<img[^>]*(?=.*(height=(?:3D)?""1(?:px)?""))(?=.*(width=(?:3D)?""1(?:px)?""))(?=.*(alt=(?:3D)?""""))[^>]*>)"
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-04 18:00

Your pattern on regex101 results in "catastrophic backtracking". :lol:

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-04 18:28

palinka wrote:
2023-08-04 18:00
Your pattern on regex101 results in "catastrophic backtracking". :lol:
Not sure which format you use on regex101 but VBScript and JavaScript is Perl style formatting (ECMAScript).
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-04 18:39

SorenR wrote:
2023-08-04 18:28
palinka wrote:
2023-08-04 18:00
Your pattern on regex101 results in "catastrophic backtracking". :lol:
Not sure which format you use on regex101 but VBScript and JavaScript is Perl style formatting (ECMAScript).
You're right, as usual. I used php format and it does work fine with ECMAScript. :mrgreen:

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-09 15:16

I have a problem with my RegEx...

https://regex101.com/r/F1ov45/1

It says 8 matches but there is only 1 (one, uno, einer) and it's the last <img ... >

If I put a newline between > and <img in the test string the match goes away...

Help ??
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-09 18:36

SorenR wrote:
2023-08-09 15:16
I have a problem with my RegEx...

https://regex101.com/r/F1ov45/1

It says 8 matches but there is only 1 (one, uno, einer) and it's the last <img ... >

If I put a newline between > and <img in the test string the match goes away...

Help ??
Try this:

https://regex101.com/r/hU1C4M/1

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-09 18:52

Looking again. This ^ picked up all image tags. Not good.

I don't understand why you care about alt="" when (width|height)=1 does the trick perfectly.

Try this one. It picks up not just the image tag, but also styling within the image and possible spaces, etc.

https://regex101.com/r/vfW7Qe/1

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-09 18:59

palinka wrote:
2023-08-09 18:52
Looking again. This ^ picked up all image tags. Not good.

I don't understand why you care about alt="" when (width|height)=1 does the trick perfectly.

Try this one. It picks up not just the image tag, but also styling within the image and possible spaces, etc.

https://regex101.com/r/vfW7Qe/1
Tried that already, I need to trap: (width="1"), (hight="1") AND (alt="") listed in any order. (alt="") may be left out but (width="1") and (hight="1") must match, not just one or the other.

For some reason I simply cannot understand, it spills over to the next tag UNLESS the tags don't "touch".
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

User avatar
jimimaseye
Moderator
Moderator
Posts: 10110
Joined: 2011-09-08 17:48

Re: Tracking Pixel / Meta Pixel

Post by jimimaseye » 2023-08-09 20:03

how about this for a starter: https://regex101.com/r/50uhw2/2

Im not fully understanding what it is you are looking for (I havent really read the thread closely) but assume you are looking for something like:

alt="" width="1" height="1" (in any combination but 'alt' will not be between width and height)


so my idea would be

(Alt - it may or may not exist here) (width or height no1) (width or height no2- as its likely to be the accompanying 'other') (alt - it may or may not exist here)

and somewhere you want a 'pix' tag? I dont thinnk I have checked for that but maybe you can use the above as a starter?
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-09 20:07

SorenR wrote:
2023-08-09 18:59
palinka wrote:
2023-08-09 18:52
Looking again. This ^ picked up all image tags. Not good.

I don't understand why you care about alt="" when (width|height)=1 does the trick perfectly.

Try this one. It picks up not just the image tag, but also styling within the image and possible spaces, etc.

https://regex101.com/r/vfW7Qe/1
Tried that already, I need to trap: (width="1"), (hight="1") AND (alt="") listed in any order. (alt="") may be left out but (width="1") and (height="1") must match, not just one or the other.

For some reason I simply cannot understand, it spills over to the next tag UNLESS the tags don't "touch".
The only case I can imagine where the height = 1px and the width would be anything other than 1px is <hr> tag. And in that case, it would not be picked up by any of our above regex patterns due to <img[^>]+

Therefore, the alt and 2nd side of height/width is not important at all. The only thing that's important is the image tag and the height -OR- width = 1.

User avatar
jimimaseye
Moderator
Moderator
Posts: 10110
Joined: 2011-09-08 17:48

Re: Tracking Pixel / Meta Pixel

Post by jimimaseye » 2023-08-09 20:16

5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-09 20:21

jimimaseye wrote:
2023-08-09 20:03
how about this for a starter: https://regex101.com/r/50uhw2/2

Im not fully understanding what it is you are looking for (I havent really read the thread closely) but assume you are looking for something like:

alt="" width="1" height="1" (in any combination but 'alt' will not be between width and height)


so my idea would be

(Alt - it may or may not exist here) (width or height no1) (width or height no2- as its likely to be the accompanying 'other') (alt - it may or may not exist here)

and somewhere you want a 'pix' tag? I dont thinnk I have checked for that but maybe you can use the above as a starter?
^ Brilliant and works with several different combinations of image tag parameters I tried.

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-09 20:26

Hmm....

I have settled with this modified suggestion by @Palinka

https://regex101.com/r/4hLDMW/1
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

User avatar
jimimaseye
Moderator
Moderator
Posts: 10110
Joined: 2011-09-08 17:48

Re: Tracking Pixel / Meta Pixel

Post by jimimaseye » 2023-08-09 20:31

Ooh, that's cutting. I'm hurt. 😪

😉

[Entered by mobile. Excuse my spelling.]
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-09 21:39

Its true that Jimi's is better.

User avatar
jimimaseye
Moderator
Moderator
Posts: 10110
Joined: 2011-09-08 17:48

Re: Tracking Pixel / Meta Pixel

Post by jimimaseye » 2023-08-09 21:42

jimimaseye wrote:
2023-08-09 20:31
Ooh, that's cutting. I'm hurt. 😪

😉

[Entered by mobile. Excuse my spelling.]
palinka wrote:
2023-08-09 21:39
Its true that Jimi's is better.
I'm just joking. 😁

(Although..... 😉😁)
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs : https://www.hmailserver.com/forum/viewtopic.php?f=21&t=26829

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-09 21:48

jimimaseye wrote:
2023-08-09 21:42
jimimaseye wrote:
2023-08-09 20:31
Ooh, that's cutting. I'm hurt. 😪

😉

[Entered by mobile. Excuse my spelling.]
palinka wrote:
2023-08-09 21:39
Its true that Jimi's is better.
I'm just joking. 😁

(Although..... 😉😁)
I wasn't joking. I tested yours with several variations of the img tag parameters. It works very well. It took me a minute to figure out how it worked. I copied it and put each match group on a single line. :mrgreen:

Seriously, it is objectively a better pattern than mine.

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-08-09 22:59

Sorry guys... It's late - credit goes to both of you ;-)

Anyways, what's with the single quote (') and the colon (:) ?

I still cannot figure out WHY the Positive Lookahead is so f'd up... It really p'sses me off.


Oh by the way, I found out that not being able to sleep at night and having a craving for food is called insomnomnomnomnia ... :roll:
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-08-10 06:16

SorenR wrote:
2023-08-09 22:59
Anyways, what's with the single quote (') and the colon (:) ?
The colon is there because I noticed that in your example, not only were there height/width "parameters" inside the tag, but also a CSS style "parameter". Colons are used in styling CSS. However, now that I'm thinking about it, if CSS is used to style the img tag, then its entirely possible the CSS for the tag could be located outside the tag itself - like inside the head tag where it normally is anyway - because the img tag may have a styling class. So I guess you can dump the colon altogether.

Code: Select all

<img ...... width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !important; ...... >
HTML tags can use either ' or ". Sooner or later you'll run into one that uses '. The trick is escaping it in VBS. I guess you'd have to use Chr(39).

gotspatel
Senior user
Senior user
Posts: 372
Joined: 2013-10-08 05:42
Location: INDIA

Re: Tracking Pixel / Meta Pixel

Post by gotspatel » 2023-09-03 09:16

@soren

can the tracking pixel be removed from the Sub OnDeliverMessage(oMessage) code itself directly or we have to make a new mail .refreshcontent and then remove the pixel and save email.

little scared as don't want to loose an important mail :oops: hence asking some dumb questions

TIA

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-09-03 15:19

gotspatel wrote:
2023-09-03 09:16
@soren

can the tracking pixel be removed from the Sub OnDeliverMessage(oMessage) code itself directly or we have to make a new mail .refreshcontent and then remove the pixel and save email.

little scared as don't want to loose an important mail :oops: hence asking some dumb questions

TIA
I don't check it any more, too many false positives... :roll:
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

gotspatel
Senior user
Senior user
Posts: 372
Joined: 2013-10-08 05:42
Location: INDIA

Re: Tracking Pixel / Meta Pixel

Post by gotspatel » 2023-09-04 08:38

Noted

but can you point out the best strategy to remove

Regards

User avatar
SorenR
Senior user
Senior user
Posts: 6367
Joined: 2006-08-21 15:38
Location: Denmark

Re: Tracking Pixel / Meta Pixel

Post by SorenR » 2023-09-04 17:55

gotspatel wrote:
2023-09-04 08:38
Noted

but can you point out the best strategy to remove

Regards
I can't remember ever having to replace a complete syntax sentence ( <img ..... > ) in HTML but since I have used RegEx and the entire search string will cover the complete syntax I would assume just using RegEx to replace it with ""... Again, I have never tried it on an email so don't say I did not warn you ;-)
SørenR.

Woke is Marxism advancing through Maoist cultural revolution.

gotspatel
Senior user
Senior user
Posts: 372
Joined: 2013-10-08 05:42
Location: INDIA

Re: Tracking Pixel / Meta Pixel

Post by gotspatel » 2023-09-19 11:11

Okay been using this since many days and no false positives yet :mrgreen: works like a charm. Thanks to @Soren, @jimimaseye &@Palinka

Here's the details.

NOTE : I am detecting the tracking pixel in Sub OnExternalAccountDownload as my hmailserver is a relay

GLOBAL RULE

NAME: REMOVE TRACKER

Criteria:
1. X-hMS-TrackingPixel Contains YES
2. X-hMailServer-Cloned NOT Contains YES
3. X-hMailServer-LoopCount Less Then 1

Action:

Run Function RemoveTrackingPixel


TO DETECT

Code: Select all

Function TrackingPixel(oMessage) : TrackingPixel = False
	'Used in Sub onExternalDownload instead of sub ondelivermessage
	If oMessage.HasBodyType("text/html") Then
		Dim i, oMatch, oMatchCollection, strRegEx
		i = 0
		strRegEx = "(<img[^>]*)(alt(=|:)(3D)?(""|')(""|'))?( )?((height|width)(=|:)(3D)?(""|')1(""|'))( )?((height|width)(=|:)(3D)?(""|')1(""|'))(( )?alt(=|:)(3D)?(""|')(""|'))?([^>]*>)"

		Set oMatchCollection = oLookup(strRegEx,ExcludeHead(oMessage.HTMLBody), True)
		For Each oMatch In oMatchCollection
			TrackingPixel = True
			i = i + 1
			'EventLog.Write( "TrackingPixel(" & i & "): " & oMatch.Value )
			EventLog.Write( "TrackingPixel(" & i & ")" )
		Next
		Set oMatch = Nothing
		Set oMatchCollection = Nothing
	End If
End Function

Sub OnExternalAccountDownload(oFetchAccount, oMessage, sRemoteUID)

	If NOT (oMessage is nothing) then
		If TrackingPixel(oMessage) And (oMessage.HeaderValue("TrackingPixel") <> "YES") Then
			oMessage.Subject = "|| " & Chr(164) & " || " & oMessage.Subject
			EventLog.Write("Tracking Pixel Found External: " & oMessage.FromAddress & " To: " & oMessage.To & " Subject: " & oMessage.Subject ) ' FOR DEBUG PURPOSE
			oMessage.HeaderValue("X-hMS-TrackingPixel") = "YES"
			oMessage.Save
		End If
	End If

End Sub
TO REMOVE

Code: Select all

Sub RemoveTrackingPixel(oMessage)
	' Called from: Global Rules Remove Tracking Pixel
	' get message and redact body.

	If oMessage.HeaderValue("X-hMailServer-Cloned") = "YES" Then Exit Sub     ' If already processed; return to rule with no action.
	If oMessage.HeaderValue("X-hMS-TrackingPixel") <> "YES" Then Exit Sub
	Dim i, oMail, strFilename, strFwdTo, matches, match
	i = 0
	With CreateObject("VBScript.RegExp")
		.Pattern = "(<img[^>]*)(alt(=|:)(3D)?(""|')(""|'))?( )?((height|width)(=|:)(3D)?(""|')1(""|'))( )?((height|width)(=|:)(3D)?(""|')1(""|'))(( )?alt(=|:)(3D)?(""|')(""|'))?([^>]*>)" '- Jimmy
		.Global = True
		.MultiLine = True
		.IgnoreCase = True
		If oMessage.HasBodyType("text/html") Then
			Set matches = .Execute(oMessage.HTMLBody)
			If matches.Count >= 1 Then 
				For Each Match In matches
					i = i + 1
					EventLogX.Write( "TrackingPixel HTML (" & i & "): " & Match.Value )
					oMessage.HTMLBody = .Replace(oMessage.HTMLBody, "<p><span style=""font-family: Verdana; font-weight: bold; color: red;"">Tracker (" & i & ") Removed</span></p><br>")
				Next
			End If
		End If
	End With
	oMessage.HeaderValue("X-hMailServer-Cloned") = "YES"
	oMessage.Save
	' Clean up
	Set oMessage = Nothing
	Set EventLogX = Nothing
End Sub


User avatar
RvdH
Senior user
Senior user
Posts: 3344
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: Tracking Pixel / Meta Pixel

Post by RvdH » 2023-09-19 11:33

what if, the message Body/HtmlBody is base64 encoded?
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

gotspatel
Senior user
Senior user
Posts: 372
Joined: 2013-10-08 05:42
Location: INDIA

Re: Tracking Pixel / Meta Pixel

Post by gotspatel » 2023-09-19 12:04

RvdH wrote:
2023-09-19 11:33
what if, the message Body/HtmlBody is base64 encoded?
Haven't seen that scenario YET :D, I don't think the trackers are base64 encoded, OFC I may be wrong :mrgreen:

Some of the different Tracking pixels I have logged

Code: Select all

1. <img src="https://adminbyrequest.us3.list-manage.com/track/open.php?u=b51984c520d5ead02815f4578&id=4634371980&e=5ae57b7b26" height="1" width="1" alt="">
2. <img width="1" height="1" style="display:none" alt="" src="https://t.sidekickopen25.com/Cto/DM+23284/cS46S04/R5R8b45dCN6tgm0N2fJzrW25fHxD3yNt35W22Y3M11XnYSjW1Gy2bc3LCDx7W22XG1925dr5MW3BPs8D1S2c7bn24VJ-T4W1">
3. <img class="mailbird" width="1" height="1" style="border:0; width:1; height:1; display: none;" src="https://tracking.getmailbird.com/OpenTrackingPixel/?messageId=Mailbird-e8154d02-2364-40bb-a998-6c7fe2c423e1@gmail.com&senderHash=6FC1A8DD234AE2F74AFC6128A1BF513622ABAD4DA0A76646293F576B71133F19&recipientHash=F82E122B4BF3900ACD11842BFFE16AF66342F2170CA9AAED46FFB0220239B69F&internalId=f23f8b04-2b88-4add-85ca-0c1e6d69ff92" alt="7cd754d8-d7b4-47a4-8f81-82bfafcf22af">
4. <img src=3D"https://ymlptr3.net/275a3geswhshrohwmeupbjjv/footer.gif" alt=3D" " height=3D"1" width=3D"1" border=3D"0">
5. <img src="https://u13058005.ct.sendgrid.net/wf/open?upn=FCtQg0tDE6Pp5diq5my-2FH3u-2FtUBc4zRde4yIBhtF8kF2wXoU12VBPVQcBZO5oM7TAlsL4tDAN-2BcRxKNA7-2Fho3WeIN7KPxrUqtFDGx9F6a9AWNGs5HGHJkUNcUDWORusgKr5xMzeRvYBxMuiuSB365gAJzNIekPjBxU-2FfaPx4lN3qvduqeWLdbXJcm23fJWALE-2BfkgQTM1Q59AcJQTriOIVwyXLku9pWFcqVPyYz3jjsm7eexPGDHr5gZK1u5rEUx1Ty5iraDF2sRq56vctd9NEO-2FqvBzQeupeqZf74RKBBvtSVHWEkw22FjRO37tkAtQU6xysoeg7lJ0-2FFOVMLMUc2VATlUTEu-2FNBi5aeoHqFubtUBGOqsSg1owPAi1lyDC6D1-2B-2F-2B3DvsY9Kaxk8AB-2BvFVHWsNffjmOi-2BSOv42z3mUp4jGQ1gHO-2FCCA-2B3LP-2F4NLLeyMQA2NGlM-2BAtDS9zKlqkRjNVjWxCBu5CF3gQvaryzI-3D" alt="" width="1" height="1" border="0" style="height:1px !important;width:1px !important;border-width:0 !important;margin-top:0 !important;margin-bottom:0 !important;margin-right:0 !important;margin-left:0 !important;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !important;padding-left:0 !important;"/>
6. <img width="1" height="1" style="display:none" alt="" src="https://t.sidekickopen25.com/Cto/DM+23284/cS46S04/R5R8b45dCN6tgm0N2fDmLW3K2V_N3yNt3_W3yPjmc1W_jBkW1Gc-FG3yLVRLW3C6qx13LFJQzW1X27Zm1S2c7bn24VJ-T4W1">

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2023-09-19 18:20

RvdH wrote:
2023-09-19 11:33
what if, the message Body/HtmlBody is base64 encoded?
Doesn't the message object contain base64 automatically decoded text?

User avatar
RvdH
Senior user
Senior user
Posts: 3344
Joined: 2008-06-27 14:42
Location: The Netherlands

Re: Tracking Pixel / Meta Pixel

Post by RvdH » 2023-09-19 20:14

Yup, looks like it is decoded automatically
CIDR to RegEx: d-fault.nl/cidrtoregex
DNS Lookup: d-fault.nl/dnstools
DKIM Generator: d-fault.nl/dkimgenerator
DNSBL Lookup: d-fault.nl/dnsbllookup
GEOIP Lookup: d-fault.nl/geoiplookup

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2024-06-11 15:58

gotspatel wrote:
2023-09-19 11:11
Okay been using this since many days and no false positives yet :mrgreen: works like a charm. Thanks to @Soren, @jimimaseye &@Palinka
I started logging these using part of your code for logging. So far all of them have been from legit messages. None found in spam. It hasn't been that long, but still.

Actually, the first one I found was very curious, which is why I came back to this thread and started logging them. I wanted to see what would come up when I loaded pixel.gif into the browser without the query string. It didn't resolve at all.

Code: Select all

<img src="https://pixel.app.returnpath.net/pixel.gif?r=96f2174af5a008f306354" width="1" height="1" />

Code: Select all

C:\Users\palinka>nslookup pixel.app.returnpath.net 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Name:    pixel.app.returnpath.net


C:\Users\palinka>
That one was found in a legit pharmacy prescription notification. So not only are they (so far) all located within legit messages, but some don't even work.

gotspatel
Senior user
Senior user
Posts: 372
Joined: 2013-10-08 05:42
Location: INDIA

Re: Tracking Pixel / Meta Pixel

Post by gotspatel » 2024-06-12 05:29

palinka wrote:
2024-06-11 15:58
gotspatel wrote:
2023-09-19 11:11
Okay been using this since many days and no false positives yet :mrgreen: works like a charm. Thanks to @Soren, @jimimaseye &@Palinka
I started logging these using part of your code for logging. So far all of them have been from legit messages. None found in spam. It hasn't been that long, but still.

Actually, the first one I found was very curious, which is why I came back to this thread and started logging them. I wanted to see what would come up when I loaded pixel.gif into the browser without the query string. It didn't resolve at all.

Code: Select all

<img src="https://pixel.app.returnpath.net/pixel.gif?r=96f2174af5a008f306354" width="1" height="1" />

Code: Select all

C:\Users\palinka>nslookup pixel.app.returnpath.net 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Name:    pixel.app.returnpath.net


C:\Users\palinka>
That one was found in a legit pharmacy prescription notification. So not only are they (so far) all located within legit messages, but some don't even work.
per this link they are inaccessible directly i think

returnpath is used by salesforce https://help.salesforce.com/s/articleVi ... htm&type=5

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2024-06-12 07:44

gotspatel wrote:
2024-06-12 05:29
per this link they are inaccessible directly i think
Out of curiosity, just how are they accessible indirectly? If my client tries to access and render the pixel, it can't if there is no dns AND i have no other software looking for it (hosts file or some security app or whatever). I don't even see the point.

I'll add dns Lookup to my logging and see if that's common.

gotspatel
Senior user
Senior user
Posts: 372
Joined: 2013-10-08 05:42
Location: INDIA

Re: Tracking Pixel / Meta Pixel

Post by gotspatel » 2024-06-12 08:43

palinka wrote:
2024-06-12 07:44
gotspatel wrote:
2024-06-12 05:29
per this link they are inaccessible directly i think
Out of curiosity, just how are they accessible indirectly? If my client tries to access and render the pixel, it can't if there is no dns AND i have no other software looking for it (hosts file or some security app or whatever). I don't even see the point.

I'll add dns Lookup to my logging and see if that's common.
¯\_(ツ)_/¯ trying to figure out how does this work in the first place :lol: , will update if something comes up.

palinka
Senior user
Senior user
Posts: 4619
Joined: 2017-09-12 17:57

Re: Tracking Pixel / Meta Pixel

Post by palinka » 2024-06-13 17:31

Meaningless trivia, but I started logging the pixel trackers and so far, only the returnpath.com one above didn't have any dns records. I noticed many are cnames.

Post Reply