11

Some people and companies embed hyperlinked images in their emails in order to keep track of which recipients read the emails, and when. When the recipient opens the email and their email client asks the server for the embedded image, the sender gets a log of that. Usually, the URL to the image is unique, that way the image server can tell exactly which email just got opened. However, in many cases the URL is not unique. I have seen the following line in several emails from at least two senders:

<img class="" src="https://mail.google.com/mail/u/0/images/cleardot.gif">

I have unencoded the string above into plain HTML. In the email, it is usually in quoted-printable format, so the = characters turn into =3D.

How does this hyperlinked image track recipients? It can obviously get your IP address and the time you opened it, but that doesn't seem very helpful. I don't understand why anyone would include this image without a unique URL.

3
  • 1
    Another reason to always read email in plain-text only.
    – Synetech
    Commented Oct 15, 2013 at 14:18
  • 1
    There is also a discussion on the Gmail Help Forum: productforums.google.com/forum/#!topic/gmail/dEgRYxLWDjA There a Google representative claims that the image is being used just as a spacer. Commented Dec 9, 2016 at 9:03
  • 1
    A 1x1 spacer. Only for the eagle-sighted among us, or the very gullible.
    – user1032346
    Commented May 6, 2019 at 21:17

2 Answers 2

13

The user identification (or tracking) does not need to be encoded in the GET URL. In some cases some information can be collected from the "Referer:" header URL. Though in many cases the information would come from cookies.

E-mail opened in a web browser

In my case when I open the URL

https://mail.google.com/mail/u/0/images/cleardot.gif

in Firefox, the browser sends 11 cookies! Most of them contain relatively long encoded or random strings. Here is the list --- URL the cookie lives with and the cookie names:

  • https://mail.google.com/mail --- GX, GXSP (contains just a single letter)
  • *.google.com --- APISID, HSID, NID, OGP, OGPC, PREF, SID
  • https://*.google.com --- SAPISID, SSID

This test was done with profile on which I use my Google accounts. I also tested a private browsing profile which did not have any cookies. I opened http://www.google.com/ and then the cleardot.gif URL and my browser was happily sending two cookies: NID and PREF.

E-mail opened in a mail client

Most of mail clients with a GUI use an existing HTML rendering core. For example Thunderbird uses Gecko (the same core as in Firefox). When a resource has to be accessed over HTTP/HTTPS (e.g. an image) cookies are sent the same way as in a web browser.

I checked which cookies I have in Thunderbird and I have the following ones:

  • *.google.com --- NID, PREF

Both cookies can be found in Firefox too and according to the description provided by Google they are being used for storing user preferences and advertisement related tracking. Both works for users which are not logged into a Google account.

Thunderbird and Firefox do not share the same set of cookies. Your login to Google account in Firefox cannot be simply related to displaying of e-mails in Thunderbird.

Summary

Google can use the embedded image to get the information as you suggested and something more by using the cookies:

  • IP address and geographical location
  • time of displaying of an e-mail
  • type and platform of the client software
  • assigning the events to users (by utilizing cookies)
  • assigning the events to a Google user when the e-mail is displayed in a web browser or possibly when the user clicks a special link in the e-mail to open it in a web browser

It seems that the tracking image is being used for collecting statistical data, not for tracking behaviour of individual Google users.

Here is description of some of cookies used by Google, another description from a 3rd party: Main cookies used by Google.

2
  • I can see that Firefox shares cookies when I visit that URL, but does Thunderbird (my mail client) share cookies? Which mail clients keep cookies, and which do not?
    – SerMetAla
    Commented Oct 13, 2013 at 23:51
  • @SerMetAla: I exteded the reply. I am interested in which e-mails did you find the image? I tried to send an HTML mail from Gmail but there was not any image in it? Would it be possible to put here some mail headers from e-mails which contain the image? I would be interested if they were the first e-mail or a reply/forward, which mail client was used and what was the routing path of the e-mail. Commented Oct 15, 2013 at 14:15
0

Check out Christopher Heng's Image Guard Script. The link will help answer this question as well as teach you how to build one.

The CHImageGuard PHP Script

Edit 2021-July 11 Below is the resulting email from the the code that follows. Many thank to the above link that taught me how! Please note I honored his request not to redistribute until the down vote to this answer.

{Email} en43/PM/Do Not Send resources

grepotrax.webege [email protected] via srv41.000webhost.com Nov 29, 2013, 5:10 AM to me

WARNING:

http://en43.grepolis.com/game/index?login=1&p=3430151&ts=1385719773 viewed en43/PM./Do Not Send resources traffic.forum.png 72.89.191.58

{END Email} Was produced by this code. That I learned how to make at above link

<?php
$agent=@$HTTP_USER_AGENT;
$ip=@$_SERVER['REMOTE_ADDR'];
date_default_timezone_set('America/New_York');
$date = date('m/d/Y H:i:s ', time());       // Human Readable
$unix = time();   // based on seconds since standard epoch of 1/1/1970
// ---------------- CONFIGURABLE SECTION -----------------
// Where is this image guard script placed in grepolis forum?
//-------------------------------------------------------------------
 $ig_name = "IG.19.12";
 $world = "us19";
 $tab  = "Res";
 $thread = "Resource Requests";
 $forum = ($world ."/" . $tab . "/" . $thread);
// Please modify the following or it will not work on your website.
// Where did you actually put your images?
// Make sure that the path you put below ends with
// a directory slash ("/"). The script below assumes it.

// $imagedir = "/put/your/full/image/directory/path/here/" ;
//------------------------------------------------------------------
$imagedir = "http://grepotrax.webege.com/IMAGES/icing-cake2.jpg/,
             http://grepotrax.webege.com/IMAGES/BigG_Bday_cake.jpg/,
             http://grepotrax.webege.com/IMAGES/traffic.message.png/" ;

// What are the websites (hostnames) that can use this image?
// If your site can be accessed with or without the 
// "www" prefix, make sure you put both here. Do not put 
// any trailing slashes ("/") nor any "http://" prefixes.
// Follow the example below.

//------------------------------------------------------------------
$validprefixes = array (
  "www.grepotrax.webege.com",
  "grepotrax.webege.com") ;

//What is the main page of your website? Visitors will be directed here
//if they type "http://www.example.com/chimage.php" in their browser.
//$homepage = "http://www.thesitewizard.com/" ;

//------------------------------------------------------------------
$homepage = "http://grepotrax.webege.com/";
// What is your email address?
// If you want to be informed when someone tries to use
// this script to access an image illegitimately, you
// must uncomment (remove the "//" prefix) from the following
// line and change it to point to your email address.
//------------------------------------------------------------------
// $email = " " ;




function isreferrerokay ( $referrer, $validprefixes )
{
$validreferrer = 0 ;
$authreferrer  = current( $validprefixes );
while ($authreferrer) {
  if (eregi( "^https?://$authreferrer/", $referrer )) {
    $validreferrer = 1 ;
    break ;
  }
  $authreferrer = next( $validprefixes );
}
return $validreferrer ;
}

//----------------------- main program -----------------------

$image = $_GET['image'] ;
$referrer = getenv( "HTTP_REFERER" );
if (isset($_GET['image'])) {

if (empty($referrer) ||
  isreferrerokay( $referrer, $validprefixes )) {

  $imagepath = $imagedir . $image ;

  $imageinfo = getimagesize( $imagepath );
  if ($imageinfo[2] == 1) {
    $imagetype = "gif" ;
  }
  elseif ($imageinfo[2] == 2) {
    $imagetype = "jpeg" ;
  }
  elseif ($imageinfo[2] == 3) {
    $imagetype = "png" ;
  }
  else {
    header( "HTTP/1.0 404 Not Found" );
    exit ;
  }

  header( "Content-type: image/$imagetype" );
  @readfile( $imagepath );

}
else {

  if (isset($email)) {
    mail( $email, "us19/Res/Resource Requests",
       "WARNING:\n\n$referrer\nviewed $forum\n$image\n$ip",
       "From: grepotrax.webege <$email>" );

// test 15-Oct 2013 1.31 WD

// Info to be sent to the table forum_tracker

$query = "INSERT INTO us19_forum_tracker VALUES ('','$unix','$date','$referrer','$ip','$forum','$image','$ig_name','','')";

// Make a MySQL Connection

   mysql_connect("mysql14.000webhost.com", "a8440417_wuzla", "MYPASSWORD") or die(mysql_error());

   mysql_select_db("a8440417_Grepo") or die(mysql_error());

   mysql_query($query);

   mysql_close();
 }
  header( "Content-type: image/png" );
  @readfile( "http://grepotrax.webege.com/IMAGES/traffic.forum.png" );
//OR NEXT LINE IF COLOR IS WRONG
//@readfile( "http://grepotrax.webege.com/IMAGES/traffic.message.png" );
}
}
else {
header( "Location: $homepage" );
}

//FORUM LINK IN IMAGE TAG
[img]http://grepotrax.webege.com/IG.19.12.php?image=traffic.forum.png[/img]
?>

Note the above script is as old as the question. This was before I knew we could use invisible boxes :) CREDITS TO THE SITEWIZARD.COM for teaching me how to use an image to to track anything I want if you were not using a VPN. Back then I could use your browser history check for link:visited status to find if you used facebookcom, walmart.com or AARP.com and base the rest of what you might see off that info. Not cool just like this script I did not want to make so easily available considering it is just the tip of an iceberg.

Reading https://superuser.com/editing-help#images it appears I am permitted to use the script above connected to an image I set the size of right here on superuser.com 1px 1px transparent maybe.

Nothing stops me from collecting website address, question being viewed anything in the address bar along with the visitors browser, IP address, how they got here and a completely terrifying number of other things.

A require statement server side could be used to make sure the image will only show if example.com is open in a browser tab. Just so happens I can go hunting for all sorts of stuff with that.

Can I embed a google sheet to live feed the results here too?

Down Vote put me on a tirade and close to seeing just how vulnerable my information is on the stack exchange family of sites. I am no threat to anyone and just dont have interest in a stack attack to prove a point. I can get a text message every time this page is viewed!

How did I end up here in the first place?... 25 Edits later

1
  • 1
    Please quote the essential parts of the answer from the reference link(s), as the answer can become invalid if the linked page(s) change.
    – DavidPostill
    Commented Jun 3, 2021 at 7:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .