Lost images in emails

[TrevorW1]

Over last seven days when receiving emails from a tour operator the main body of text and pictures do not open, emails from everyone else open correctly.  I use webmail on laptop and gmail on Android phone. Strangley if I go to my sons house and log into his BT wiFi the emails open correctly on both laptop and Android phone, also if I forward the emails to my wifes Gmail address they also open corectly. I have checked that the always open images is ticked.

[Gondola]

Excellent. Grateful thanks for the confirmation as that does positively confirm that the network blocking is as a direct result of the sending of some suspicious images via MailChimp emails.

Good to know you've alerted Middletons so that they can take up the issue directly with MailChimp. From what I've seen, unless Middletons have been directly contacted by MailChimp about their security then I'd not expect to see any adverse effects from viewing Middletons' emails. i.e. those are expected to be safe.

However, the fact that global security information suggests that spoof emails purporting to be from MailChimp may contain images hosting nefarious malware download links the same safety assumption cannot be made for all MailChimp emails. 

[TrevorW1]

Yes Scam Protection is turned off with dot in middle of off cicle. I have just treid the link and all my middetons emails and they are now all showing the images.

Thanks very much for your advice and you have now solved the problem

[Gondola]

Just to clarify, In your MyAccount you're saying that the Scam Protection setting is definitely shown as Off with a dot in the Off circle? And this makes no difference to whether the email images are shown in emails and you don't see a button in the email to 'Show images' and you still don't see the images via a browser when selecting this link from Middletons: https://mailchi.mp/1edf2ed5be3f/great-yarmouth-the-norfolk-broads

[TrevorW1]

Thanks Gondola , I had switched all of above off in MyAccount including Scam protection.

I have been reading your replies  to jbuchanangb and have forwarded your advise about Mailchimp being blocked to Middletons for them to look into

[Gondola]

Scam Protection has a separate switch off in your customer MyAccount so although part of the HomeSafe/KidsSafe protection suite it needs switching off separately. 

HomeSafe : Scam Protection

[TrevorW1]

Good Morning Gondola. I am sorry, I did not realise you are not employed by TalkTalk and volunteer your time ,you have resolved problems for me in the past. Many thanks for the time you have spent on this problem including your valuable Sunday.

Both myself and my brother have Homesame/Kidsafe switched off as our F-Secure antivrus protects us.

I am in my late 70's and do not feel confident in changing Router settings. 

For now I have arranged for Middletons to send emails to a new gmail account and hopefully I will then be able to view them.

Best Wishes

Trevor

[Gondola]

If you want the situation escalating to TalkTalk's IT people with a complaint that it's the new webmail platform that's at fault then feel free to make that complaint directly to TalkTalk.  I don't agree that it's anything to do with TalkTalk Mail.

Just to clarify, I'm not employed by TalkTalk as I'm simply a volunteer to Community. 

My TalkTalk package does not use HomeSafe Scam Protection so I cannot switch that on / off to check. But I can view the images. I have sent the image links via TalkTalk Mail and the new platform and can still resolve those images. You say you can also resolve those images via the emails when using non-TalkTalk ISP services.

Have you or your brother, when testing using TalkTalk broadband, switched off HomeSafe Scam Protection via your customer MyAccount?

Are the other two Middletons customers also both customers of TalkTalk or different providers?

Your own testing confirms that the emails open normally on your devices via non-TalkTalk ISP services. So all I ask you to do is switch off Scam Protection via your customer MyAccount and that would confirm it's a network block for those mailchimp image links.

I can give you a workaround if you wish. That's to use a non-TalkTalk DNS in your router so that will bypass HomeSafe service protections. This is the alternative to switching off Scam Protection to test.

Try the secure Quad9 DNS: Primary 9.9.9.9 and Secondary 149.112.112.112 or Google DNS: Primary 8.8.8.8 and Secondary 8.8.4.4 (or a combination of Quad9 as Primary and Google as Secondary)

To change the DNS settings in your router, follow these steps:

• On a device connected to the router
  Open a Web browser, type http://192.168.1.1 into the address bar
• Tap Enter/Return
• Enter the username and password and click OK
  Note: The default username is admin (all in lower case).
  The router password is printed on the label on the back of the router.
• HG633 router password - top of the label
• DSL-3782 router password - middle of the label to the left of the bar-code
• Sagemcom FAST 5364 router password - under the pull-up wireless password card on the label directly above the S/N barcode.

For the HG633 router

• Select Internet (top blue bar)
• Select Internet Connection and then the grey Edit button
• Scroll down and tick the Static DNS box
• Enter the preferred Primary DNS numbers 9.9.9.9
  Enter the Secondary DNS numbers 8.8.8.8
• Click the Save button
• Scroll up and click Logout (grey button top right)

For the DSL-3782 router

• In the Web browser address bar, type http://192.168.1.1/cgi-bin/New_GUI/Dns.asp
• Tap Enter/Return
• Tick 'Use the following DNS Server Address'
• Enter the preferred (Primary) and alternate (Secondary) DNS addresses
• Click the Save button

For the Sagemcom FAST 5364 router

• From the Dashboard
• Select See internet settings
• Select Manage advanced settings
• Select the Internet Connectivity icon
• Select IPv4
• In the DNS drop-down box select Manually Specify DNS
  DNS1 enter the Primary DNS
  DNS2 enter the Secondary DNS
• Click the Apply button

If you subsequently choose to return to the TalkTalk DNS the numbers are 79.79.79.79 and 79.79.79.80

Here is the TalkTalk advice and router setup needed to restore TalkTalk DNS Third Party DNS (Click here)

[TrevorW1]

Hello Gondola

I did what you asked and I still see nothing even when I click through to mailchimp.

I logged into some friends BT and Virgin WiFi and the emails  from Middletons open okay in both of my devices.

I logged into my brothers TalkTalk WiFi and they will not open on laptop or Mobile. Strangely if he looks at his emails from Middletons they do not open in Talk Talk webmail but do in his Yahoo email account.

I have spoken to two other clients of Middletons who have the same problem.

Since this is happening in both of my devices it suggests nothing has been changed in them .That suggests the problem is due to the Webmail update changing something and it need escalating to your IT poeple

I have F-Secure Virus protection on laptop and Sophos on Mobile have tried them disabled but still cannot see pictures or text, The article you refer to regarding mailchimp being hacked three times was from January 2023

[Gondola]

A little bit more research into MailChimp reveals, courtesy of Computer Weekly, that MailChimp has been hacked three times very recently. Customer details stolen and spoofed emails may be sent out by scammers. Therefore, it's highly likely that some MailChimp customers could have had spam emails sent and highly likely in that event that some image links have included hidden pixel malware downloads.

Therefore always wise to keep your anti-virus and anti-malware up to date. Further advice from Malwarebytes - Full version free for 3 devices with eero 6 packages from TalkTalk.

[Gondola]

I can see the images via a browser. I've checked via Firefox, Chrome and Edge. All OK. As a standalone browser is totally unlinked from TalkTalk Mail the root cause cannot possibly be webmail related.

So what I'd suggest to troubleshoot is to launch the Chrome browser. Reset the browser settings to make sure all browser extensions are removed and default settings are set up. Put this in the address bar: chrome://settings/reset and then select Restore settings to their original defaults and the blue button Reset settings. Then put the image URL in the browser address bar:  https://mailchi.mp/1edf2ed5be3f/great-yarmouth-the-norfolk-broads

And tell me what you see.

And just to add that I see another customer has reported that the HomeSafe Scam Protection being switched off for the viewing of MailChimp emails does effect a fix.

HomeSafe blocking is what I'd concluded at the outset if you look back at my first reply. However, I didn't expect to see Scam Protection blocking mailchimp email images unless some nefarious activity has been detected with hidden pixel malware being downloaded along with the images from certain mailchimp emails.

But when you've concluded that the images are still blocked after a Chrome browser reset then go into your MyAccount and switch off Scam Protection and then retest.

[TrevorW1]

No I cannot see them on Android , TalkTalk webmail or Outlook 2021 or on  Browser.

I see that jbuchanangb (Philosopher) is also having the same problem so suggests it is something to do with the new Webmail

[Gondola]

Apart from the deprecated SHA1 certificate there's not a problem that I see at first glance and I can view the images from the tour company both current and past and confirm the certificate is valid and certificate chain is complete. 

But you're not seeing the images at all?

[TrevorW1]

Hi Gondola  When I click view in browser it shows as https://mailchi.mp/1edf2ed5be3f/great-yarmouth-the-norfolk-broads?e=eadcd04a31

I have tried to attach a screenshot of certificate below but do not know if you cansee it. 

Common Name (CN)

mailchi.mp

Organisation (O)

<Not part of certificate>

Organisational Unit (OU)

<Not part of certificate>

Issued By

Common Name (CN)

R3

Organisation (O)

Let's Encrypt

Organisational Unit (OU)

<Not part of certificate>

Validity Period

Issued On

Thursday, 17 August 2023 at 10:39:38

Expires On

Wednesday, 15 November 2023 at 09:39:37

Fingerprints

SHA-256 fingerprint

13 D1 5D 43 74 03 9F A1 DB 25 AF 20 43 BF 61 8A 10 AD 43 C8 65 B3 2E F1 49 74 CE AF 25 0C 0A A7

SHA-1 Fingerprint

DE 69 81 12 44 BC 64 D8 8B 20 3D FD D0 72 B2 90 42 B6 47 C7

[Gondola]

Linked images on a website will normally be secured with a valid certificate and certificate chain. So, I'm thinking that for those having trouble viewing the images there is a certificate validation issue. What would be useful is to know the website address and the certificate issuer that you see.

Via your TalkTalk broadband connection when trying to view these linked images via a browser you'll see in the address bar a padlock icon and if you click on the padlock you'll be able to view the certificate information. Who is the issuer for the certificate for those linked images?

[TrevorW1]

Thanks Chris Yes telephone number is correct

[Chris-TalkTalk]

OK thanks. Is the telephone number in your community profile your current TalkTalk landline telephone number?

Chris

[TrevorW1]

Yes tried Homesafe/Kidsafe on and off it made no difference. I see that jbuchanangb (Philosopher) is also having the same problem so suggests it is something to do with the new Webmail

[Chris-TalkTalk]

OK thanks Trevor, have you tried Gliwmaeden2's suggestion?

Chris

[TrevorW1]

Although images suddenly started opening on my Gmail on Android phone they later stopped working again ?

[Gliwmaeden2]

@TrevorW1, you need to check settings in Homesafe  - it is not the same as F.secure / Supersafe:

https://community.talktalk.co.uk/t5/Articles/How-to-use-HomeSafe/ta-p/2205196