There is an overview of the SPAM Blocking process here.
Images
Embedded Screen Images
When a large image is detected forming the majority of the body of the email, the email will be designated as SPAM. This trick is often used by spam to avoid having any identifiable textual content in their email. Both single large images and multiple small images tiled to make up a large image are blocked. Almost certainly a good indication of spam!
When an image map is detected forming the majority of the body of the email, the email will be designated as spam. This trick is often used by spam to avoid having any identifiable textual content in their email. Image maps are very very rarely used by legitimate email.
When a large image is detected forming the majority of the body of the email, the email will be designated as spam. This trick is often used by spam to avoid having any identifiable textual content in their email. Both single large images and multiple small images tiled to make up a large image are blocked. Almost certainly a good indication of spam!
When an image is detected with the wrong type specified for its extenion or content type this rule is triggered. Almost certainly a good indication of spam!
This rule identifies email where a small image used to track receipt of the email is found. These webbugs are often found in SPAM and very rarely in other mail shots and email marketing, but never in 'normal' email
This list allows the configuration of image hosting service matching expressions.
When an expression matches it will perform the action specified for the expression.
The expression type shows the type of expression the matching engine will use for the entered expression.
Expressions have a built in precedence: Allow > Delete > Block > Mark > Weight
Remember that your SPAM Blocker/Action settings may globally preclude one or more of these actions.
Case insensitive substring
simply "match" or "sub(match)"
sub(mail) matches the phrase "Hexamail produces server software"
Case sensitive substring
"SUB(match)"
SUB(mail) does not match the phrase "HexaMail produces server software"
Case insensitive exact match
"cmp(match)"
cmp(mail) matches ONLY the entire exact string "mAil"
Case sensitive exact match
"CMP(match)"
CMP(mail) matches ONLY the entire exact string "mail"
Case insensitive word match
" match " or "word(match)"
word(mail) does not match the phrase "Hexamail produces server software" but does match the phrase "Hexamail produces mail server software"
Case sensitive word match
"WORD(match)"
WORD(Mail) does not match the phrase "Hexamail produces mail server software" but does match the phrase "Mail server software produced by Hexamail"
Case insensitive wild match
"*m?tch*" or "wild(*m?tch*)" (? - single character match, * - multiple character match)
Example wild(*v?agra*) matches the phrase "Hexamail does not ship v1agra"
the * wrappers round wildcard expressions, you can also do wild(Start*) to match the phrase "Start of the content" but not match "the content starts here"
Case sensitive wild match
"WILD(m?tch)"
WILD(*v?agra*) does not match the phrase "Hexamail does not ship V1agra"
the * wrappers round wildcard expressions, you can also do WILD(*End) to match the phrase "The content End" but not match "the content ends here"