This Stock" emails and I am finding that the pictures contained in them all have a portion of a line of source that says...src="cid:
*ANY* inline image of any sort is going to contain that tag. That is what links to the other mime section containing the image.
There are quite a number of rules for image stock spams. The ImageInfo and FuzzyOCR plugins also help quite a lot in these cases, as do many SARE rules and the network rules.
Loren
