This pattern, if added to Blacklisted Patterns, will block all mail from email addresses containing the word bounce:
/(From:|Return-Path:).*(bounce\@|bounce.*\@)|(\@bounce|\@.*bounce)/
The next pattern we use to block mails from addresses containing "mx" after the @ sign and had a 3 part domain name (e.g. [email protected]):
/(From|Return\-Path).*\@(mx.*|.*mx.*)\..*\..*/
You should monitor your server after adding patterns to the pattern filter, an incorrectly formatted pattern may block legitimate mail. To monitor a whitelisted pattern search Reporting->History for mails scoring over 90 (the pattern filter will add a score of 100 when triggered). The "bounce" pattern in particular will result in some false positives as sites like ebay, facebook, linkedin, ebay and others use bounce addresses for their notification mails. You may need to whitelist some domains to ensure all legitimate mails is delivered.
