MailBot by Tavel — email accounts creator, checker and unlocker

MailBot has been updated to version 16.54.

Since September 20, 2024, Microsoft has almost completely disabled authentication via regular password (PLAIN method) on its IMAP, SMTP and POP3 servers, leaving only the OAuth2 option (XOAUTH2 method). As of today, only a few servers remain unpatched, and it is almost impossible to authenticate with a regular password on Outlook mail servers.

If you try to authenticate with a regular password, for example, the Outlook SMTP server will respond with this error:

535 5.7.139 Authentication unsuccessful, basic authentication is disabled.

and the Outlook IMAP server will respond with this one:

001 NO AUTHENTICATE failed.

To some extent, this also affected MailBot, since the verification of recovery emails in the program is carried out via the IMAP protocol.

In connection with this, a new setting “Authentication” appeared in the recovery email source settings window in MailBot, which is a list with two values:

• Plain password
• OAuth2

When connecting Outlook accounts as recovery emails, you now need to select only OAuth2, and the format of the recovery emails in the file should look like this:

username@hotmail.com:password:refresh_token

A semicolon is also supported as a separator.

An example of what Microsoft’s OAuth2 refresh token looks like:

Where can I get this refresh token?

Now some Outlook account shops have already started selling accounts bundled with a ready-made refresh token, for example, a purchased account may look like this:

All you need to do is copy the value from the “RefreshToken” field to the end of the line with the Outlook recovery mailbox.

Most likely, in the future, all shops will supply Outlook accounts bundled with an OAuth2 refresh token, but I understand that MailBot should also be able to generate a refresh token for the Outlook accounts it creates, so this article will have a second part when such functionality is implemented.

Attention! MailBot assumes that the refresh token was received for the Mozilla ThunderBird IMAP client, which has the ClientId 9e5f94bc-e8a4-4e73-b8be-63364c29d753 in Outlook.
If the refresh token was obtained for a different ClientId, authentication will not be successful.
It is also assumed that the refresh token was received with permissions that include IMAP access.

The OAuth2 method is now supported for the ride for Mail.ru, Yahoo and AOL.com IMAP servers, the format of recovery emails in the file is the same as for Outlook, the refresh token must also be received for the Mozilla ThunderBird ClientId. For these email providers, authentication via plain password is still possible, so selecting “OAuth2” in the “Authentication” setting is not necessary for them.

Also is implemented in MailBot 16.54:

• full support for new CAPTCHA type: CloudFlare Turnstile
• a “Default” button has been added to the “Profile” tab, which inserts the string %DEFAULT% into the “Template” field
• a new setting “Connect to IMAP server via current thread proxy” has been added to the form for editing the recovery email source
• a new setting “STARTTLS” has appeared in the recovery email source editing window
• support for the feedbackTask method in the CapSolver API
• for VAK-SMS an additional mirror domain moresms.net has been added
• added Google Chrome 128 fingerprint

Fixed:

• the “X seconds before first request of result” timeout on the CAPTCHA service account edit form can now be set to 0 seconds (previously it was at least 1 second)
• a rare error with the text like Code from the verification letter on recovery email "username@email.com" is "" when searching for a letter with a verification code
• WP.pl and O2.pl modules
• error EEmailAPIRecoveryEmailSendCode: {"State":200} after sending an email with a verification code to a recovery mailbox
• detection of an external IP address in Outlook creator
• re-confirmation of recovery email when linking it to an Outlook account
• a rare EFormURLNotFound error when retrieving a signup form in Yahoo/AOL.com creators
• Yandex checker and creating app passwords in Yandex module
• transliteration of first and last names for most European languages ​​(as well as pinyin) when generating a username for email account

автор tavel \\ теги: AOL, IMAP, Mail.ru, MailBot, O2.pl, OAuth2, Outlook, POP3, SMTP, Turnstile, VAK-SMS, WP.pl, Yahoo, recovery email, Yandex