Thursday, July 16, 2009

Barracuda SPAM Filter Header Blocking Rules

Here is a list of regex filters that has been working good for catching SPAM on our Barracuda SPAM filter.


X-Barracuda-Connect:.*.*(-|\.)([a-z]{0,8})cable(\.|-|\d+\.|\d+-)
X-Barracuda-Connect:.*.*(-|\.)(cablelink|dyn|home|range|ppp|pool|pools|user|wifi|xdsl)(\.|-|\d+\.|\d+-)
X-Barracuda-Connect:.*.*(-|\.)cable([a-z]{0,8})(\.|-|\d+\.|\d+-)
X-Barracuda-Connect:.*.*(catv\d+|\.catv|catv-)
X-Barracuda-Connect:.*.*(dynamic|dynamicip)(\.|-|\d+\.|\d+-)
X-Barracuda-Connect:.*.*\.(chello|direct-adsl)\.nl\[
X-Barracuda-Connect:.*.*\.arpa(\.|\[)
X-Barracuda-Connect:.*.*\.dsl\..*\.net\.br\[
X-Barracuda-Connect:.*.*\.edu\.tw\[
X-Barracuda-Connect:.*.*\.internetdsl\.
X-Barracuda-Connect:.*.*\.leased(-|\.)
X-Barracuda-Connect:.*.*\.mindspring\.com\[
X-Barracuda-Connect:.*.*\.ono\.com\[
X-Barracuda-Connect:.*.*\.proxad\.net\[
X-Barracuda-Connect:.*.*\.tpnet\.pl\[
X-Barracuda-Connect:.*.*\.voip\.canet\.ne\.jp\[
X-Barracuda-Connect:.*.*\.wanadoo\.fr\[
X-Barracuda-Connect:.*.*\d+\.speedy\.
X-Barracuda-Connect:.*.*adsl_
X-Barracuda-Connect:.*.*dhcp
X-Barracuda-Connect:.*.*dial(up|in|pool|\.|-|\d+\.|\d+-)
X-Barracuda-Connect:.*.*dsl\.ip\.
X-Barracuda-Connect:.*.*dyn(ip|dsl|adsl|pool)(-|\.)
X-Barracuda-Connect:.*.*ipconnect\.
X-Barracuda-Connect:.*.*modem
X-Barracuda-Connect:.*.*net\.ru\[
X-Barracuda-Connect:.*.*ppp(oe|ool)
X-Barracuda-Connect:\s([a-z]{1,1})([0-9]{5,12})
X-Barracuda-Connect:\s(client-|host|host-|igld-)\d+(-|\.)\d+(-|\.)\d+(-|\.)\d+
X-Barracuda-Connect:\s(osh-nat|adsl|bsn|xdsl|leased|bzq|spb|pool|ppp|dyn|home|user|\d+user|ip-nat|nat|cable|cablelink|chello|cpc|wifi)(-|\.|\d+\.|\d+-)
X-Barracuda-Connect:\sc-\d+-\d+-\d+-\d+\.hsd1\.
X-Barracuda-Connect:\scpe-\d+-\d+-\d+-\d+.*\.rr\.com\[
X-Barracuda-Connect:\sdpc\d+\.direcpc\.com\[
X-Barracuda-Connect:\shost-ip\d+-
X-Barracuda-Connect:\sip-(1|([3-9]))\d+-\d+
X-Barracuda-Connect:\ssoftbank\d+.*.*\.bbtec\.net\[
X-Barracuda-Connect:\sunknown\[(201|204|205|208|209|214|215|217|221)\.
X-Barracuda-Connect:\sunknown\[(80|81|83|84|86|87|88)\.
X-Barracuda-Connect:\sunknown\[124\.
X-Barracuda-Connect:\sunknown\[151\.
X-Barracuda-Connect:\sunknown\[189\.
X-Barracuda-Connect:\sunknown\[190\.
X-Barracuda-Connect:\sunknown\[4[^1]
X-Barracuda-Connect:\sunknown\[58\.
X-Barracuda-Connect:\sunknown\[9

No comments:

Post a Comment