Hi! Thank you very much for your answers. Now I'm quite close to undertand it

I can see the relation between "cid " tag and the image embedded on the message, this is from the headers of the first message:

Code:
Content-Type: image/gif;
	name="lowness.gif"
Content-Transfer-Encoding: base64
Content-ID: <001001c63cbf$c8a626b0$40277854@hnuka>
This is the content called by (on the body of message):

Code:
<DIV><FONT face=Arial size=2><IMG alt="" hspace=0 
src="cid:001001c63cbf$c8a626b0$40277854@hnuka" align=baseline 
border=0></FONT></DIV>
But still I don't understand:

1.- This is very "smart" way of fool the filter since the text is actually an image, which is unreadable by it. Nevertheless I can't see any attachment on the message but I can see the image on the body
2.- What's the relation between this and the tracking? I mean, I can't understand if the "src" for the "image" is a URL, but how can you track an image embedded on the mail??

Thank you for share your knowledge!!