"TheBat!" programme and its use.

[Manny]

Those headers would indicate a USA IP address. Together with "The Bat!" would indicate a potential scammer.

One of the IP's in there flags up iffy on Google: See Here

Moby of course would suggest she had a US VPN that she used for her job and being Russian, is a proficient "The Bat!" user, just like his step son, MIL, wife, cat, neighbour and postman (when not on strike). Her dubious IP address is because she shares a wireless connection with Fat Yuri of course.

[Vinnvinny]

But lets just say you are corresponding with beautiful Natasha from Krasnoyarsk. Her email is nat48693@mail.ru (fictitious email). Her mother is in the hospital, she was mugged last night walking home from her job as a hairdresser, and she used the last of her money to send you a long, detailed email of these events from the internet cafe. You receive the email and read with great curiosity of these events and her peculiar life in a far away Siberian city. She expresses her gratitude toward you for being so kind, understanding and handsome. She now feels that she just cannot live without you. You smile, touched by her kind words toward you and so intrigued by the thoughts of this gorgeous Siberian lady. You check the email headers and they look like this:

X-Apparently-To:   xxxxxxxx@yahoo.com Mon, 03 Mar 2008 09:57:59 -0800
X-Originating-IP:   [68.142.237.91]
Return-Path:   <nat48693@mail.ru>
Authentication-Results:   mta216.mail.re3.yahoo.com from=yahoo.com; domainkeys=pass (ok)
Received:   from 68.142.237.91 (HELO n6.bullet.re3.yahoo.com) (68.142.237.91) by mta216.mail.re3.yahoo.com with SMTP; Mon, 03 Mar 2008 09:57:59 -0800
Received:   from [68.142.237.89] by n6.bullet.re3.yahoo.com with NNFMP; 03 Mar 2008 17:57:58 -0000
Received:   from [69.147.75.183] by t5.bullet.re3.yahoo.com with NNFMP; 03 Mar 2008 17:57:58 -0000
Received:   from [127.0.0.1] by omp104.mail.re1.yahoo.com with NNFMP
X-Yahoo-Newman-Id:   245207.32258.bm@omp104.mail.re1.yahoo.com
Received:   (qmail 40509 invoked from network); 3 Mar 2008 17:57:58 -0000
Received:   from unknown (HELO ?192.168.0.4?) (nat48693@mail.ru with plain) by smtp115.plus.mail.re1.yahoo.com with SMTP; 3 Mar 2008 17:57:57 -0000
X-YMail-OSG:   
X-Yahoo-Newman-Property:   ymail-3
Date:   Mon, 3 Mar 2008 20:57:58 +0300
From:   This sender is DomainKeys verified nat48693@mail.ru  Add sender to Contacts
X-Mailer:   The Bat! (v3.0.1.33) Professional
Reply-To:   nat48693@mail.ru
X-Priority:   3 (Normal)
Subject:   Hello my dear!!!
In-Reply-To:   <41633.2324.qm@web32704.mail.mud.yahoo.com>
References:   <1637647.20080205242@yahoo.com>
MIME-Version:   1.0
Content-Type:   text/plain; charset=us-ascii
Content-Transfer-Encoding:   7bit
Content-Length:   3737

 

I’d expect everything is now tickety boo in old Krasnoyarsk. Moms new hip is just swell to match her ankles, the mugger has gone to meet his creator to due the Austin vigilante mob being there on a timely holiday and our gal is in early and pleasant conversation with a Marcel from Holland.

I would suggest to her though that next time it might be quicker to send a letter as 18 months is just too long for an email to arrive.

[msmoby]

Moby of course would suggest she had a US VPN that she used for her job and being Russian, is a proficient "The Bat!" user, just like his step son, MIL, wife, cat, neighbour and postman (when not on strike). Her dubious IP address is because she shares a wireless connection with Fat Yuri of course.

Moby would say Manny just proved he didn't read post no.9 of this thread ..


PS don't do a whois search on whois 69.147.75.183 ..

[el_guero]

MOBY!

You didn't mention that IP ADDY!!!

Now they are monitoring alllll of our computers.



oh well, I haven't done anything illegal lately, have you quit doing what you used to?

 

Moby of course would suggest she had a US VPN that she used for her job and being Russian, is a proficient "The Bat!" user, just like his step son, MIL, wife, cat, neighbour and postman (when not on strike). Her dubious IP address is because she shares a wireless connection with Fat Yuri of course.

Moby would say Manny just proved he didn't read post no.9 of this thread ..


PS don't do a whois search on whois 69.147.75.183 ..

[msmoby]

MOBY!

You didn't mention that IP ADDY!!!

Now they are monitoring alllll of our computers.



oh well, I haven't done anything illegal lately, have you quit doing what you used to?

 

What VPNs ..?  NO.. I still do that !

[el_guero]

Just fly NOE and stay under radar . . .

 

That red flag will take some time to get off of their watch list.

[Boris]

Tania uses The Bat. I used the Bat while at her apartment. We are both scammers. Hey el_guero, I have this hot cousin from Minsk. She could really use a new bikini and her Mercedes is a little out of style. Maybe you could help a girl out. 

[el_guero]

Boris,

I would love to help a lady out, but that might get me in trouble with my girlfriends.

 

wayne

Tania uses The Bat. I used the Bat while at her apartment. We are both scammers. Hey el_guero, I have this hot cousin from Minsk. She could really use a new bikini and her Mercedes is a little out of style. Maybe you could help a girl out. 

[FreeThinker]

Yesterday day I got another bat in my mailbox, Nasty creatures  

X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MDtTQ0w9MA==

X-Message-Status: n:0

X-SID-PRA: singlwooman@yahoo.com

X-AUTH-Result: NONE

X-Message-Info: JGTYoYF78jGQEDLaumGixLsACb7eYJX0uBCuC/XT5lyzkOwAQd1oCtyMg13Cxs8CLsq3ycm1a8B9PLfvGVPbaPjXvp4ijWNyjz4ShBhdmjw=

Received: from smtp105.plus.mail.re1.yahoo.com ([69.147.102.68]) by bay0-mc1-f32.Bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);

    Sun, 27 Jun 2010 10:36:25 -0700

Received: (qmail 87588 invoked from network); 27 Jun 2010 17:36:25 -0000

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

  s=s1024; d=yahoo.com;

  h=DKIM-Signature:Received:X-Yahoo-SMTP:X-YMail-OSG:X-Yahoo-Newman-Property:Date:From:X-Mailer:Reply-To:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type;

  b=MnnEeIdVAEDg2lV6dqOLuDUuA+2szZqVmcFH+L4RjpVun3ZK7wUQuR3+yw5+xRneju+i1sHmPJx7SmpbhFpVsLzt7zPHu3ZZ8fB3yFHbX/EwohYXHZM/1RDXdfvKiCkEh9EHEOHprfVtnowtkHXCdtMH9yAqxIO6j6P/I38b638=  ;

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1277660185; bh=YP0V6R+/L5DUNhyKpOlp8nXbMh+KGdarFpJbsREqCpU=; h=Received:X-Yahoo-SMTP:X-YMail-OSG:X-Yahoo-Newman-Property:Date:From:X-Mailer:Reply-To:X-Priority:Message-ID:To:Subject:In-Reply-To:References:MIME-Version:Content-Type; b=uWq+kYVAdSJLukhLBVynIbSYHiUvaX+QwktExEYMwo13/lV0iwguesYMabmTnoS3fhEBcRh3rJ1XJ5z2akGEKuXX9RL/bbQBj0ZCGKnrM18ghukpM/8KF8wot7zR3SGCJ/3+WX5n2jLpbJRQSeGxSHcs6sW/rTmcdj+apEvPVFo=

Received: from redwolf.mshome.net (singlwooman@188.72.210.88 with plain)

        by smtp105.plus.mail.re1.yahoo.com with SMTP; 27 Jun 2010 10:36:21 -0700 PDT

X-Yahoo-SMTP: kJMvf2mswBCUSKpjs5JwNlwTuTXjrZ2I

X-YMail-OSG: 4MWGk0UVM1mzPKZ10_2Y2Z881mVxm16QUkYYpFswGSY1Zoe

 jBvzyFuUn1rJaPJdYnkN1R0dPv6crRrT4LSamKz0YrQGx535XnV8NP1PbfXE

 FAX.kb.Q5WIOPXIQ.gsGNTj45ahFCr8CNb95NgJ7gR8xuzkEo7LLTsdnKJFq

 NK1NMD2c_z1VGNHbIde55dofrc.1EkeGg1vN8TgqA_9yR9gkPGH3jrHACNIA

 efQRhLxIx_21dYmNtT2JVNHSiwpSF20QlZa4BBQKIqngQD6P6m7uOmuo91v5

 CDh9J2wbrJIk8UM2eJvH8PNY2XEm3Co.rfWW4K3w3cg2JYshURzdour8ziHM

 XfpB4UsFA3XTAid3Hj4cZYLh0G5..MMPjHsTHC2MdFaM-

X-Yahoo-Newman-Property: ymail-3

Date: Sun, 27 Jun 2010 20:43:32 +0300

From: singlwooman@yahoo.com

X-Mailer: The Bat! (v2.12.00) Educational

Reply-To: singlwooman@yahoo.com

X-Priority: 3 (Normal)

Message-ID: <222283757.20100627204332@yahoo.com>

To: XXXXXXX <xxxxxx@hotmail.com>

Subject: Hello XXXXXXXXX!

In-Reply-To: <BAY116-W51DF8FD71FE9AE6DB5FCFEDCC90@phx.gbl>

References: <BAY116-W51DF8FD71FE9AE6DB5FCFEDCC90@phx.gbl>

MIME-Version: 1.0

Content-Type: multipart/mixed;

 boundary="----------989C23E39CF0B23"

Return-Path: singlwooman@yahoo.com

X-OriginalArrivalTime: 27 Jun 2010 17:36:25.0709 (UTC) FILETIME=[445F61D0:01CB161F]



------------989C23E39CF0B23

Content-Type: text/plain; charset=us-ascii

Content-Transfer-Encoding: 7bit



Hello XXXXXXXX! I am very glad, that you have answered me. As you remember, I

Has written to you on a site of acquaintances. I saw your profile and have turned

Attention to you. My name is Natalya. To me of 28 years, I have no children and

When was not married! I wish to tell at once to you, that I search for the man

For the serious relation. I have found you and I wish to begin with you friendship

And if between us there will be a good relation even to construct

Happy family. I want that you did not play game, did not correspond with

Other girls. Certainly I cannot forbid to do to you it, but I

I think that if you want with me the serious relation you will not be

To do it. I do not want any games, because recently it

It is often noticed on the Internet, I do not wish to waste time for nothing.

XXXXXXX, I think, that you understand about what I write to you. My interests -

Only the serious relation, I wish to correspond with you for studying

Each other and in the future to meet, have a happy life. I not

One all life wishes to be, I do not want this lonely life which I have

Now. I not the little girl and already think of creation of the family. But

One prevents to make it to me - I have no good man: (Sebasiaan, I

I live in Russia, in other country, but I hope that it not a problem for

Relations, I hope that the distance between us will not frighten you. With

The first letter between us there should be a truth and sincerity. Only so

We can construct the strong, strong relation. As speak, distinction in

To culture, at age, language, and the distance cannot be a problem for

Love. And I support this expression. If you wish to learn me

Better, write to me and I will answer you next time with fuller

The information on me. In each letter you can see my photos. I

I hope that it will be it is pleasant to you. Because on a photo you can

To see I wash appearance, my eyes. And eyes is a mirror of soul. If you

Wish to be assured in me, in my reality you can hear

My voice. Be not afraid to write to me your phone number, I can

To call to you. I think to you it will be pleasant to hear my voice. I

Well I speak in English. In this letter I also send to you

My photo. Now I finish my letter to you. I with hope will be

To wait your letter. Care of itself. Yours faithfully Natalya.

------------989C23E39CF0B23

Content-Type: image/jpeg; name="x_3b275336.jpg"

Content-transfer-encoding: base64

Content-Disposition: attachment; filename="x_3b275336.jpg"

[msmoby]

I will have to stop folk wring to me via yahoo/ hotmail / outlook / thunderbird - as I get similar mesages via these clients, too .. Even my Wife get similar emails to the one above...

The use of one particular client - in isolation - is NOT an indicator of being a scammer

[msmoby]

OMG.. I cannot edit spelling mistakes ...

So here the edit in full


"I will have to stop folk writing to me via yahoo/ hotmail / outlook / thunderbird, et al  - as I get similar messages via these clients, too 

 Even my Wife get similar emails to the one above...

The use of one particular client - in isolation - is NOT an indicator of being a scammer "

Hmm .....is there some sort of inference I might edit a post for nefarious means...?   

[dbneeley]

Over the years, "The Bat" has been a very popular stand-alone Windows email client in the FSU, where it originates. To think that it is somehow an indicator of nefarious activity is actually kind of funny.

When I first came to the FSU about ten years ago, its use was very widespread IIRC. These days, it's obviously still out there but just as another email program.

David

[Manny]

There has been some recent discussion of The bat! on >> this topic<< recently. Rather than derail that topic, I am quoting a line from a reply of Moby's there and replying it here instead where I feel it is more on topic.

The use of 'the Bat!' is no more a red flag than Outlook, Thunderbird, mail.ru, etc.,...

Yet, we hear little about Outlook or Thunderbird in email headers do we? 

OK, I'll bite again. Why would a woman who uses mail.ru, inbox.ru or a similar FSU based online email client possibly need such a programme? Why would the average Smokinhotkova need templates? Moreover, why would such a woman need a programme allowing three different levels of template creation? Perhaps the average Smokinhotkova desperately needs extensive automation of almost every aspect of e-mailing? I think not.

A number of Internet service providers, sites and organizations claim that The Bat! is a spamming tool and, on that basis, block messages containing "The Bat!" in the X-Mailer header.

I maintain that while many innocent users use The Bat!, it remains a useful tool in a scammers arsenal, and that is why it is a common denominator in the headers of scammers emails. And that is why we must treat it with caution.

[msmoby]

The use of 'the Bat!' is no more a red flag than Outlook, Thunderbird, mail.ru, etc.,...

Yet, we hear little about Outlook or Thunderbird in email headers do we? 

OK, I'll bite again. Why would a woman who uses mail.ru, inbox.ru or a similar FSU based online email client possibly need such a programme? [/quote]

Most obviously 'spammy' stuff we get is from webmail...

We tend to use email clients if we have more than one email address.. If ladies / men are dating - and are SENSIBLE.. they can use one email for filtering out the dross and another for if/when someone makes the grade....  *I* did this.. did that make ME a spammer ?

Why would the average Smokinhotkova need templates? Moreover, why would such a woman need a programme allowing three different levels of template creation? Perhaps the average Smokinhotkova desperately needs extensive automation of almost every aspect of e-mailing? I think not.

AGAIN... Why does the step-son use it on PCs...?  'cos it isn't an MS product .. not to spam..
'Cos he is deemed an expert, HE puts in on folks' pcs.. Grandma, Veta's sister et al ..they aren't spammers, EITHER..   Email clients can pull in one's mail.ru, gmail / yahoo / hotmail all to one place and can sent using the email address one chooses... Saves all that logging into multiple sites

A number of Internet service providers, sites and organizations claim that The Bat! is a spamming tool and, on that basis, block messages containing "The Bat!" in the X-Mailer header.

Yes, I've found that wiki site, too - the source is an 'expert' called 'spam guy' and dates from 2006.... he says "To date, we've never received any legit e-mail with "The Bat" in the header. " 

I maintain that while many innocent users use The Bat!, it remains a useful tool in a scammers arsenal, and that is why it is a common denominator in the headers of scammers emails. And that is why we must treat it with caution.

Who is WE ??! Folks relying on near six year old misinfo ?!  ..

[siberia]

   i will reiterate what I said in this thread a long while ago, and what Moby just said.  In FSU, GENERALIZING, they do not like M$, and they have a friend of a friend of a friend, install things on their pc. The IT people there use the Bat, for home, for work, for all. Therefore the woman you write to may be using the Bat for their mail client.

Again, it does not preclude it from usage by spammers but it does not mean a woman using it is a scammer.

[andrewfi]

Manny, many women use email clients rather than webmail. More than that many people in general do so.

Why use them instead of webmail?
One very good reason is that they work offline. With webmail one has to be connected to the internet all the time.

There are many reasons why people want or need to work offline.

Do people who use Outlook use all its functionality? Of course most do not, just as you only touch the surface of Word, or Excell.

The problem is that by instructing people to run up a red flag based upon the email client that might be in use is madness.
The truth is that a genuine user of email as a scamming tool is more likely than the general population to be aware of how their tools work - just as you are much more familiar with the tools of your trade than I am with your tools.
That means that if I were a genuine scammer and was aware of my environment then, just as I'd have learned to rein in the money letter a little and to not always use pics of models in my profiles, I would also flick the switch within The Bat! that makes it send out email headers for other email clients - is basic stuff.

The person who will not flick the switch is the person who is genuine - of that you can be sure.

Does that mean that no scammers use The Bat! and do not modify the headers to spoof some other client? Of course not.
What is does mean is that, at best, one can only proceed on the basis of what the person communicates within the emails and then the choice of email client matters not one whit.

Think of it this way: If you get a suspicious email or two from some profile claiming to be in Russia would you decide she was straight if you saw she used Outlook or reject her because she used The Bat! ?
My guess is that you wouldn't, you'd reject her because of what she wrote, therefore making the choice of email client a criteria of judgement is irrelevant - and worse yet misleading.

[Manny]

The person who will not flick the switch is the person who is genuine - of that you can be sure.

Not so. Most scammers don't bother hiding the Bat header. They assume western blokes are too dim to pick up on it.

Also, if a reputable programme for Joe Soap, why does it have the capability to disguise itself? 

[andrewfi]

Manny, you made the point for me.

Why bother to change at all? There is no reason to do so. But if there was then people'd do it. Guess what, you would never know!
Did you know that other software uses The Bat!'s header until I told you it did?
No you didn't.
Did you know that The Bat! could have its headers changed until I told you?
No you didn't.

So, now you know that all those emails you thought were sent by The Bat! by nasty people might not have been sent using The Bat! For sure, you now know that they might NOT have been and thus you can no longer make judgements on the basis of what you see in the headers of emails.

Did you know that you can change the headers used by Microsoft Outlook?
Oh noes, Microsoft Outlook is for spammers and scammers, yes?
Did you know that spammers spoof headers to look like they are sent using Outlook?
Time to change the email client we use, right now!

To repeat what I wrote up thread, most software has functionality that is not used by most people. The fact that this functionality exists does not indicate the usage of that software by its general users.

Here's what you CAN safely say about emails received with a header that indicates it was sent using The Bat!

'Some people who send email are scammers. Some people who send email are spammers. Some people who send email as scams or spam use a popular email client called The Bat!. There is software that pretends to be The Bat! which has as its purpose the sending of email spam messages.'

Here's what you CAN safely say about emails received with a header that indicates it was sent using Microsoft Outlook:

'Some people who send email are scammers. Some people who send email are spammers. Some people who send email as scams or spam use a popular email client called Microsoft Outlook. There is software that pretends to be Outlook which has as its purpose the sending of email spam messages.'

See the difference between the two statements about two bits of software?

It is always dangerous to make to great an inference from limited data. When that data is updated as yours has been then sometimes the inferences need to be changed because whilst they might have been poor inferences before, with improved knowledge their quality may decrease even further.

Always the important thing to look at is what somebody writes. The pen they use to write the message or the paper upon which they write is immaterial. (OK, when I worked in the newspaper industry we knew that letters written in green ink were invariably written by nutters but that was a special case)

[Manny]

Manny, you made the point for me.

Why bother to change at all? There is no reason to do so. But if there was then people'd do it. Guess what, you would never know!
Did you know that other software uses The Bat!'s header until I told you it did?
No you didn't.
Did you know that The Bat! could have its headers changed until I told you?
No you didn't.

So, now you know that all those emails you thought were sent by The Bat! by nasty people might not have been sent using The Bat! For sure, you now know that they might NOT have been and thus you can no longer make judgements on the basis of what you see in the headers of emails.

Rather, you made the point for me.

So now you assert that Fat Yuri & Co all use other programs and insert The Bat! headers?

I don't buy that for a moment, but lets for a moment assume it is the case. That means emails from scammers often contain headers indicating The Bat!. Which is what I said........

None of this alters the fact that many scammers letters contain The Bat! headers. This isn't just my sole opinion. Type "Ukraine scam The Bat!" into Google and you get eight million results. Are they all coincidences too?

[Vinnvinny]

I'm of the opinion that if a guy needs to look at 'headers' in an email to see if he is being scammed then its likely at some stage he will be scammed anyway, so it's a bit of a waste of time.

[shakespear]

I'm of the opinion that if a guy needs to look at 'headers' in an email to see if he is being scammed then its likely at some stage he will be scammed anyway, so it's a bit of a waste of time.

I think there is a lot of truth to what you're saying here Vinny.  I agree with Manny that it is a potential "red flag" but certainly not a blanket disqualification by any means.   

[msmoby]

Jeez, so many guys who SHOULD know better are STILL accepting the 6 year old ramblings of non too savvy 'experts' over reality and giving AWFUL 'advice' ....


Anyway, I've changed my profile avatar to that of a mother of a lad who installed "the Bat!" on PCs - simply because it wasn't an MS product..

[msmoby]

roses and scammers clearly go together 

[fireeater]

roses and scammers clearly go together 

So what was Veta's cut for the fake flower delivery.   

Think about it Moby. 

[Geraldneoft]

so if SHE is allergic, he wears a latex, then a lambskin.  If HE is allergic, its the other way around.  If BOTH parties are allergic, then its lambskin, latex, lambskin.

Are there other alternatives to all this layering? What do you do?