Here's a recent suggestion that was published into a KB article!
Sophos XG Firewall / UTM: How does Pharming protection work
.