Ike,

Here are a few that might be of use.

They are of limited use for trapping SPAM(30%)....but they can be of some help.

[enabled],"IANA RESERVED","IANA RESERVED",180,AND,Delete,EntireHeader,containsRE,\[([1257]|2[37]|3[1679]|4[129]|5[089]|7\d|8[3-9]|9\d|1[01]\d|12[0-6]|17[3-9]|18[0-79]|19[07]|22[3-9]|2[34]\d|25[0-5])(\.[12]?\d?\d?){3}\]



[enabled],"RIPE (Europe)",RIPE,180,AND,Delete,EntireHeader,containsRE,\[(62|8[0-2]|19[345]|21[237])(\.[12]?\d?\d?){3}\]


[enabled],"APNIC (Asia-Pacific)",APNIC,180,AND,Delete,EntireHeader,containsRE,\[(6[01]|20[23]|21[01]|21[89]|22[0-2])(\.[12]?\d?\d?){3}\]


[enabled],"LACNIC (Latin America",LACNIC,180,AND,Delete,EntireHeader,containsRE,\[20[01](\.[12]?\d?\d?){3}\]

Great! I'll try them out.

You've included the multicast address space in this but that's OK, multicast addresses shouldn't appear as the source for emails either.

_________________

CastleCopsWiki

Ikeb,

That is the reason the multicast space is included.

Also, If you want you could begin the Regex with something that will limit the search to the "Received: from" lines in the header. It might speed things up.