Re: Pretending to use The Bat!
* MAU writes: As many of you know, blaming The Bat! for spam is not an new issue. Look what I got yesterday: [...] Yes, hits=6.5 required=5.0 tests=FORGED_MUA_THEBAT,MDAEMON_SPAM_BLOCKER version=2.54 ** Start SpamAssassin results 6.50 points, 5 required; * 3.0 -- Message has been marked by MDaemon's Spam Blocker * 3.5 -- Forged mail pretending to be from The Bat! End of SpamAssassin results Some sysadmins are just stupid. I am NOT pretending to use The Bat!, I _am_ _using_ The Bat! As far as I know FORGET_MUA_THEBAT also checks whether the Message-ID is TB!-like ... just to have »The Bat!« as X-Mailer is not enough to make this rule match. Carsten -- Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Roman Katzer everyone else, on 19-Feb-2005 at 05:40 you (Roman Katzer) wrote: Interesting. This SpamAssassin must really be badly maintained. Actually, it's pretty well maintained Everyone can fake the X-Mailer header so that it contains the identification of a genuine mail program. The spam I get claims to be (or is) written with Microsoft Outlook Express, CommuniGate Pro, SquirrelMail, and whatnot. Does anyone increase the spam rating of a message by that X-Mailer? No. It is flawed idea first place to take the X-Mailer into account for spam identification. I've yet to make up my mind if I will bother myself with starting a discussion about that on the SA bugzilla. :-) -- Best regards, Alexander (http://www.neurowerx.de - ICQ 238153981) The real art of conversation is not only to say the right thing at the right time, but also to leave unsaid the wrong thing at the tempting moment. Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Mica,
%COMMENT=This is The Bat!, (wo)man. :tbflag: Accept this fact, leave
this message alone (virgo intacta) and live in peace.
I think I'm going to do something like that. Great Idea! :-)
But I doubt that anyone could talk effectively with an administrator, or
even anti-spam *company*, wh{o|ich} filters spam by *MUA*. (-;
Agree :)
--
Best regards,
Miguel A. Urech (El Escorial - Spain)
Using The Bat! v3.0.2.10
Current version is 3.0.1.33 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Robin, Well, so am I. But to prevent possible problems such as you encounter, I disguise my mailer slightly - see my X-mailer header. Actually, I use one of a list of 21 equivalents to The Bat! in a variety of languages. But that is still like hiding part of my identity and I don't see why I have to do it. I think Ritlabs should change TB's name to 'The Best!'. That way we could still call it TB. ;-) -- Best regards, Miguel A. Urech (El Escorial - Spain) Using The Bat! v3.0.2.10 Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Alexander, On Sat, 19 Feb 2005 10:03:08 +0100 GMT (19/02/2005, 16:03 +0700 GMT), Alexander S. Kunz wrote: ASK Everyone can fake the X-Mailer header so that it contains the ASK identification of a genuine mail program. The spam I get claims to be (or ASK is) written with Microsoft Outlook Express, CommuniGate Pro, SquirrelMail, ASK and whatnot. Does anyone increase the spam rating of a message by that ASK X-Mailer? No. The faked X-Mailer a spam software created was a TB version, but there was another header in those mails that wold be created only by Outlook, X-MSMail-Priority: Normal. That's how the faked X-Mailer could be identified as fake. This: http://www.silverstones.com/thebat/spammer.html says it all. -- Cheers, Thomas. Ever notice that PRICE and WORTH mean the same thing, but priceless and worthless are opposites? -- Jay Trachman Message reply created with The Bat! 3.0.2.10 under Windows XP 5.1 Build 2600Service Pack 2 Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Thomas Fernandez everyone else, on 19-Feb-2005 at 13:53 you (Thomas Fernandez) wrote: The faked X-Mailer a spam software created was a TB version, but there was another header in those mails that wold be created only by Outlook, X-MSMail-Priority: Normal. That's how the faked X-Mailer could be identified as fake. I know. There's a couple of other indications for a forged X-Mailer string together with the The Bat! vX.X identifier. But thats not the point. The point is that a totally legit message created with TB v3.0.2.10 or 3.0.1.33 will get a spam rating from SA because of the wrong FORGED_MUA_THEBAT problem, so I'm back to my statement that they shouldn't consider the X-Mailer header at all for spam classification, but who am I... -- Best regards, Alexander (http://www.neurowerx.de - ICQ 238153981) Deliplayer2 is playing: Where? by Mathuresh from the 1995 album 'Link' Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Alexander, Saturday, February 19, 2005, 3:08:08 PM, you wrote: ASK The ASK point is that a totally legit message created with TB v3.0.2.10 or 3.0.1.33 ASK will get a spam rating from SA because of the wrong FORGED_MUA_THEBAT ASK problem, so I'm back to my statement that they shouldn't consider the ASK X-Mailer header at all for spam classification, but who am I... Alexander S. Kunz, unless that is a forged sender name! :-) -- Best Wishes, Mark using The Bat! 3.0.2.10 Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Pretending to use The Bat!
Hello all, As many of you know, blaming The Bat! for spam is not an new issue. Look what I got yesterday: MDaemon has indentified your message as spam. It will not be delivered. From : [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject : [***SPAM*** Score/Req: 06.50/05.00] (Archive Copy) [EAME_Newsletter] Issue 57 - Thursday, February 17, 2005 Message-ID: [EMAIL PROTECTED] Yes, hits=6.5 required=5.0 tests=FORGED_MUA_THEBAT,MDAEMON_SPAM_BLOCKER version=2.54 ** Start SpamAssassin results 6.50 points, 5 required; * 3.0 -- Message has been marked by MDaemon's Spam Blocker * 3.5 -- Forged mail pretending to be from The Bat! End of SpamAssassin results : Message contains [1] file attachments Some sysadmins are just stupid. I am NOT pretending to use The Bat!, I _am_ _using_ The Bat! -- Best regards, Miguel A. Urech (El Escorial - Spain) Using The Bat! v3.0.2.10 Winamp Playing: Ed Hamilton - Fly Like An Eagle (Smoothjazz.Com - The worlds best Smooth Jazz - Live From Monterey Bay) Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
-BEGIN PGP SIGNED MESSAGE- Hello All, Friday, February 18, 2005, 9:48:12 AM, MAU wrote: M As many of you know, blaming The Bat! for spam is not an new issue. Look M what I got yesterday: MDaemon has indentified your message as spam. It will not be delivered. From : [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject : [***SPAM*** Score/Req: 06.50/05.00] (Archive Copy) [EAME_Newsletter] Issue 57 - Thursday, February 17, 2005 Message-ID: [EMAIL PROTECTED] [SNIP!] What's the rest of the header look like? I didn't see anything identifying MUA or MTA in the section you quoted. - -- * * Best regards, * Marc. * New Orleans, LA (USA) * FIDONET=1:396/45 INTELEC=239:600/70 * INTERNET: marc.lewis at sstar dot com * TELNET://sursum-corda.com * BBS, DATA FAX: 1-504-897-6006 * Message not valid without my PGP signature. -BEGIN PGP SIGNATURE- Version: PGP SDK 3.0.3 Comment: iQEVAwUBQhYWVwHUq78/EfsHAQHutgf/XgQdDD/DOgPwf8nNtt8GF0jQ5poHq6OT rLuTkZX1ywkiQYQNWtM/0rLbKsbkBDVP2YQ1oB3Bd1mz3XLuX6S+u79DQHQ12vMt YgG6kP2kzsVdHlsKgAYRSn4Ka3XDMseUKGJE3gveKk9ggJP35jT1Nf38Ct3jLwxp 76gKNE+QkYtk1g7WajdlRf0sO77TKtm0ySxYG7jvI1NQpuvXVSUIyNE8tT2hzSrg 3hOSs31FVJCHkmUYAcf6pad4OpaKwJlFZm2g1GwJDMW8W7xz4jJ0kZiAjtOZo8ub /WxLp+j5+jgzXKsAeXMrvsRZbAwiYZOtecrWXZNykmatqmDBqIccIw== =zAnG -END PGP SIGNATURE- -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.306 / Virus Database: 265.8.9 - Release Date: 2/17/2005 Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello MAU everyone else, on 18-Feb-2005 at 16:48 you (MAU) wrote: Start SpamAssassin results 6.50 points, 5 required; * 3.0 -- Message has been marked by MDaemon's Spam Blocker * 3.5 -- Forged mail pretending to be from The Bat! End of SpamAssassin results : Message contains [1] file attachments Some sysadmins are just stupid. I am NOT pretending to use The Bat!, I _am_ _using_ The Bat! Interesting. This SpamAssassin must really be badly maintained. I sent a support inquiry to my provider yesterday because I get this in my mails as well, to be precise the very same FORGED_MUA_THEBAT_CS I told them that TheBat is not a forged MUA, but I have little hope that it will actually change anything, this topic has been brought up often enough and nothing has changed ever since. -- Best regards, Alexander (http://www.neurowerx.de - ICQ 238153981) Deliplayer2 is playing: Sundown (Ionizer Remix) by The Overlords from the 1996 album 'Infinite Excursions' Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
MAU @ 2005-Feb-18 10:48:12 AM Pretending to use The Bat! mid:[EMAIL PROTECTED] As many of you know, blaming The Bat! for spam is not an new issue. Look what I got yesterday: SNIP Start SpamAssassin results 6.50 points, 5 required; * 3.0 -- Message has been marked by MDaemon's Spam Blocker * 3.5 -- Forged mail pretending to be from The Bat! End of SpamAssassin results : Message contains [1] file attachments Some sysadmins are just stupid. I am NOT pretending to use The Bat!, I _am_ _using_ The Bat! Because of its macros and templateing system, The Bat! has been considered a spam tool by some anti-spam companies. You can turn off the X-Mailer header. Options - Preferences = General - UNCHECK Use X-Mailer header in messages -- Chris Quoting when replying to this message is good for your karma. Using The Bat! v3.0.1.33 on Windows XP 5.1 Build 2600 Service Pack 2 Accessing a POP3 mailbox. How do I set my laser printer on stun? pgp9mhybJOtSu.pgp Description: PGP signature Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Marc, What's the rest of the header look like? I didn't see anything identifying MUA or MTA in the section you quoted. What I quoted is the error message I received, not the headers. -- Best regards, Miguel A. Urech (El Escorial - Spain) Using The Bat! v3.0.2.10 Winamp Playing: Vernon Neilly and G-Fire - LFO. (Smoothjazz.Com - The worlds best Smooth Jazz - Live From Monterey Bay) Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Alexander, I told them that TheBat is not a forged MUA, but I have little hope that it will actually change anything, this topic has been brought up often enough and nothing has changed ever since. Yes, it is a difficult battle. What I did was to let the recipients know that their sysadmin or postmaster is blocking the newsletter they have subscribed to because they want to receive it. -- Best regards, Miguel A. Urech (El Escorial - Spain) Using The Bat! v3.0.2.10 Winamp Playing: Vernon Neilly and G-Fire - LFO. (Smoothjazz.Com - The worlds best Smooth Jazz - Live From Monterey Bay) Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Chris, You can turn off the X-Mailer header. Options - Preferences = General - UNCHECK Use X-Mailer header in messages Yes, I know. But I don't want to hide the fact that I am using The Bat!. I _am_ proud of using TB. -- Best regards, Miguel A. Urech (El Escorial - Spain) Using The Bat! v3.0.2.10 Winamp Playing: Hall and Oates - I'll Be Around (Smoothjazz.Com - The worlds best Smooth Jazz - Live From Monterey Bay) Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hello Chris everyone else, on 18-Feb-2005 at 17:59 you (Chris) wrote: Because of its macros and templateing system, The Bat! has been considered a spam tool by some anti-spam companies. AFAIK there once was a bulk email software that would create fake X-Mailer headers. But, in that software one could also select Outlook Express as mailer, and no one filters mails from that mailer. :-) The term forged MUA indicates that the guys who made this antispam solution simply don't know their stuff (or don't care), because TB is not forged, but a genuine program. -- Best regards, Alexander (http://www.neurowerx.de - ICQ 238153981) Egotist: a person more interested in himself than in me. -- Ambrose Bierce Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
***^\ ._)~~
~( __ _o Was another beautiful day, Fri, 18 Feb 2005,
@ @ at 18:21:49 +0100, when MAU wrote:
I don't want to hide the fact that I am using The Bat!. I _am_ proud
of using TB.
We have even TB flag(s). (-:
So we can evoke them using :xxx: form of smiley codes as a part of
comment line in header part of a message, and to corroborate our
statement by picture, which talks more than 10.000 words.
Something like this:
%COMMENT=This is The Bat!, (wo)man. :tbflag: Accept this fact, leave
this message alone (virgo intacta) and live in peace.
But I doubt that anyone could talk effectively with an administrator, or
even anti-spam *company*, wh{o|ich} filters spam by *MUA*. (-;
- --
Mica
PGP key uploaded at: http://pgp.mit.edu/ once just before breakfast
:eyes:
[Earth LOG: 170 day(s) since v3.0 unleashing]
OS: Windows 98 SE Micro Lite Professional IVa Enterprise Millennium
with nestled ZipSlack(tm) 9.1 UMSDOS Linux, and with Bochs 2.1.1
with a small DLX Linux; and, for TB sometimes, Gentoo and Vector
via Wine...
-BEGIN PGP SIGNATURE-
iD8DBQFCFi2K9q62QPd3XuIRAuoXAKCU7P7oijcca7vpwhiPcsZ0t5Lx2ACdHRXN
5rQuCeZoQpedYVHrwVXTVEk=
=tBGN
-END PGP SIGNATURE-
Current version is 3.0.1.33 | 'Using TBUDL' information:
http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
Hi MAU, on Fri, 18 Feb 2005 18:21:49 +0100GMT, you wrote: You can turn off the X-Mailer header. Options - Preferences = General - UNCHECK Use X-Mailer header in messages M Yes, I know. But I don't want to hide the fact that I am using The Bat!. You shouldn't. M I _am_ proud of using TB. Why not. :-) You might direct them to http://www.silverstones.com/thebat/spammer.html, if you think they /might/ listen... -- Cheers Peter Progasm, n,: The feeling you get when your code works the first time Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
On Sat 19 February 2005, 4:21:49 +1000, Mau wrote: Yes, I know. But I don't want to hide the fact that I am using The Bat!. I _am_ proud of using TB. Well, so am I. But to prevent possible problems such as you encounter, I disguise my mailer slightly - see my X-mailer header. Actually, I use one of a list of 21 equivalents to The Bat! in a variety of languages. -- Robin Using The Bat! v3.0.1.33 on Windows XP 5.1 Build 2600 Service Pack 2 Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
Re: Pretending to use The Bat!
On Friday, February 18, 2005, 11:45:37, Alexander S. Kunz wrote: Interesting. This SpamAssassin must really be badly maintained. Actually, it's pretty well maintained. They just have difficulties with adjusting to new TB versions but _will_ do their best to do so. Post a bug report at http://bugzilla.spamassassin.org and send a mail to the admin of the mail server that wrongly flagged your message. Regards, Roman -- A people who expect to be ignorant and free expect what never will, and never can, be. -- Thomas Jefferson Current version is 3.0.1.33 | 'Using TBUDL' information: http://www.silverstones.com/thebat/TBUDLInfo.html
