At 3:39 PM -0500 8/21/02, Rice, MA Mark (6750 wrote:
>I get hit with these probes or "Rumplestiltskin attacks" too.
>Justin, could you explain what a "LART" is?  I've seen that term used on
>this list before...
Sure.  I described it the way I understand it to another person off
list a little while ago.
It has a couple different definitions.  The most common is Luser
[sic] Attitude Readjustment Tool.  It was first used to describe the
reporting of spam to ISPs that didn't think spam was bad.  Their
attitude needed a little readjusting.  It has since taken on the
generic meaning of reporting email/security incidents to the
appropriate parties.  Somewhere the definition is online.  I can't
seem to find the page though.
LART is about as good a word as any to describe reporting
Rumplestiltskin attacks.  Come to think of it, I generally get a much
better response to spam LARTs than I do to LARTs for other things.
I'm always careful to say in the LART that the massive amounts probes
on our system disrupted service to our customers and that we
therefore consider it a DoS attack.  That tends to ellict a better
response.  I also either include a log snippet in the email or I dump
it to a file and make it accessible on a web server with other logs
of hosts that abused our mail server.  That helps too. :)
Justin
-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Spamassassin-talk mailing list
Spamassassin-talk@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Tue, 06 Aug 2002 17:06:20 +0100 (IST)
from usw-sf-list2.sourceforge.net (usw-sf-fw2.sourceforge.net
    [216.136.171.252]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g76G62k08769 for <jm@jmason.org>; Tue, 6 Aug 2002 17:06:02 +0100
from usw-sf-list1-b.sourceforge.net ([10.3.1.13]
    helo=usw-sf-list1.sourceforge.net) by usw-sf-list2.sourceforge.net with
    esmtp (Exim 3.31-VA-mm2 #1 (Debian)) id 17c6nW-0000Bd-00; Tue,
    06 Aug 2002 09:03:02 -0700
from [194.165.165.199] (helo=mandark.labs.netnoteinc.com) by
    usw-sf-list1.sourceforge.net with esmtp (Exim 3.31-VA-mm2 #1 (Debian)) id
    17c6n2-00057X-00 for <spamassassin-devel@lists.sourceforge.net>;
    Tue, 06 Aug 2002 09:02:32 -0700
from phobos.labs.netnoteinc.com (phobos.labs.netnoteinc.com
    [192.168.2.14]) by mandark.labs.netnoteinc.com (8.11.6/8.11.6) with ESMTP
    id g76G2Np24031; Tue, 6 Aug 2002 17:02:23 +0100
by phobos.labs.netnoteinc.com (Postfix, from userid 500) id
    B11D9440E9; Tue,  6 Aug 2002 09:19:03 -0400 (EDT)
from phobos (localhost [127.0.0.1]) by
    phobos.labs.netnoteinc.com (Postfix) with ESMTP id AC6B0341C3;
    Tue,  6 Aug 2002 14:19:03 +0100 (IST)
Re: [SAdev] Adding Scripting to Spam Assassin
Message from Marc Perkel <marc@perkel.com> of
    "Sat, 03 Aug 2002 09:13:43 PDT."
    <3D4C0137.9010508@perkel.com>