Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group
Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246).
Sublime rule (View on GitHub)
1name: "Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group"
2description: "Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246)."
3references:
4 - "https://ofac.treasury.gov/recent-actions/20250701"
5type: "rule"
6severity: "high"
7source: |
8 type.inbound
9 and any(headers.ips,
10 ip.in_range(.,
11 "5.182.86.0/23", // AS210644
12 "45.12.63.0/24", // AS216246
13 "45.80.228.0/22", // AS210644
14 "45.129.125.0/24", // AS216246
15 "45.136.175.0/24", // AS210644
16 "45.136.228.0/24", // AS210644
17 "45.137.60.0/24", // AS210644
18 "45.137.81.0/24", // AS210644
19 "45.140.13.0/24", // AS210644
20 "45.141.177.0/24", // AS210644
21 "45.144.54.0/23", // AS210644
22 "45.145.13.0/24", // AS210644
23 "45.145.14.0/24", // AS210644
24 "45.146.131.0/24", // AS216246
25 "45.147.31.0/24", // AS216246
26 "45.150.32.0/23", // AS210644
27 "45.151.101.0/24", // AS216246
28 "45.151.102.0/24", // AS216246
29 "45.152.196.0/24", // AS216246
30 "45.152.198.0/24", // AS216246
31 "45.155.71.0/24", // AS210644
32 "46.226.160.0/21", // AS210644
33 "62.60.148.0/22", // AS210644
34 "62.60.156.0/22", // AS210644
35 "62.60.186.0/24", // AS210644
36 "62.60.228.0/22", // AS210644
37 "62.60.236.0/22", // AS210644
38 "77.73.131.0/24", // AS210644
39 "77.73.135.0/24", // AS210644
40 "77.110.96.0/21", // AS210644
41 "77.110.104.0/23", // AS216246
42 "77.110.106.0/24", // AS210644
43 "77.110.108.0/24", // AS210644
44 "77.110.110.0/24", // AS210644
45 "77.110.116.0/24", // AS210644
46 "77.110.118.0/24", // AS210644
47 "77.110.120.0/23", // AS210644
48 "77.221.136.0/21", // AS210644
49 "77.221.148.0/23", // AS210644
50 "77.221.151.0/24", // AS216246
51 "77.221.152.0/21", // AS210644
52 "77.232.142.0/23", // AS210644
53 "78.153.130.0/24", // AS210644
54 "79.137.184.0/24", // AS210644
55 "79.137.192.0/24", // AS216246
56 "79.137.194.0/23", // AS210644
57 "79.137.196.0/22", // AS210644
58 "79.137.202.0/23", // AS210644
59 "79.137.204.0/22", // AS210644
60 "79.137.248.0/24", // AS210644
61 "80.85.241.0/24", // AS210644
62 "81.19.137.0/24", // AS210644
63 "82.117.84.0/24", // AS210644
64 "82.117.87.0/24", // AS216246
65 "84.21.191.0/24", // AS216246
66 "84.22.148.0/22", // AS210644
67 "85.192.24.0/21", // AS210644, AS216246
68 "85.192.37.0/24", // AS210644
69 "85.192.38.0/24", // AS210644
70 "85.192.40.0/23", // AS210644
71 "85.192.42.0/24", // AS210644
72 "85.192.56.0/24", // AS216246
73 "85.192.60.0/23", // AS210644
74 "85.192.63.0/24", // AS210644
75 "89.22.224.0/20", // AS210644
76 "89.169.32.0/22", // AS210644
77 "89.169.52.0/22", // AS210644
78 "89.185.85.0/24", // AS210644
79 "89.208.96.0/23", // AS210644
80 "89.208.103.0/24", // AS210644
81 "89.208.104.0/22", // AS210644
82 "89.208.113.0/24", // AS210644
83 "91.103.140.0/24", // AS210644
84 "91.108.240.0/23", // AS210644
85 "91.108.242.0/24", // AS210644
86 "91.184.240.0/22", // AS210644
87 "92.246.136.0/22", // AS210644, AS216246
88 "94.228.162.0/23", // AS210644
89 "94.228.164.0/23", // AS210644
90 "94.228.169.0/24", // AS210644
91 "94.228.170.0/24", // AS210644
92 "94.228.172.0/23", // AS210644, AS216246
93 "94.228.175.0/24", // AS216246
94 "95.163.152.0/23", // AS210644
95 "95.163.176.0/24", // AS210644
96 "95.181.160.0/24", // AS210644
97 "95.181.162.0/24", // AS210644
98 "95.181.167.0/24", // AS210644
99 "95.181.174.0/23", // AS210644
100 "104.238.29.0/24", // AS210644
101 "109.107.181.0/24", // AS210644
102 "109.107.189.0/24", // AS216246
103 "109.107.190.0/24", // AS210644
104 "109.120.132.0/22", // AS210644
105 "109.120.138.0/23", // AS210644
106 "109.120.140.0/24", // AS210644
107 "109.120.149.0/24", // AS210644
108 "109.120.150.0/23", // AS210644
109 "109.120.152.0/24", // AS216246
110 "109.120.155.0/24", // AS210644
111 "109.120.156.0/23", // AS210644
112 "109.120.176.0/22", // AS210644
113 "109.120.184.0/22", // AS210644
114 "109.172.94.0/23", // AS210644
115 "138.124.13.0/24", // AS216246
116 "138.124.14.0/24", // AS216246
117 "138.124.18.0/24", // AS210644
118 "138.124.24.0/23", // AS210644
119 "138.124.26.0/24", // AS210644
120 "138.124.29.0/24", // AS210644
121 "138.124.34.0/23", // AS210644
122 "138.124.49.0/24", // AS210644
123 "138.124.50.0/23", // AS210644
124 "138.124.52.0/22", // AS210644
125 "138.124.58.0/23", // AS210644
126 "138.124.61.0/24", // AS210644
127 "138.124.78.0/24", // AS210644
128 "138.124.89.0/24", // AS210644
129 "138.124.90.0/23", // AS210644
130 "138.124.92.0/23", // AS210644
131 "138.124.99.0/24", // AS210644
132 "138.124.101.0/24", // AS210644
133 "138.124.102.0/23", // AS210644
134 "138.124.108.0/23", // AS210644
135 "138.124.110.0/24", // AS210644
136 "138.124.112.0/21", // AS210644
137 "138.124.124.0/24", // AS210644
138 "138.124.127.0/24", // AS210644
139 "147.45.40.0/22", // AS210644
140 "147.45.68.0/22", // AS210644
141 "147.45.72.0/21", // AS210644
142 "176.124.198.0/23", // AS210644
143 "176.124.202.0/23", // AS210644
144 "176.124.204.0/22", // AS210644
145 "176.124.220.0/22", // AS210644, AS216246
146 "178.20.208.0/23", // AS210644, AS216246
147 "178.159.94.0/24", // AS216246
148 "178.236.242.0/24", // AS216246
149 "178.236.246.0/23", // AS210644
150 "178.236.248.0/24", // AS210644
151 "178.236.250.0/23", // AS210644, AS216246
152 "178.236.252.0/24", // AS210644
153 "178.236.255.0/24", // AS210644
154 "185.68.244.0/24", // AS210644
155 "185.96.80.0/24", // AS216246
156 "185.103.100.0/22", // AS210644, AS216246
157 "185.104.151.0/24", // AS210644
158 "185.125.100.0/22", // AS210644
159 "185.197.74.0/24", // AS210644
160 "185.221.196.0/24", // AS210644
161 "185.221.199.0/24", // AS216246
162 "185.230.143.0/24", // AS210644
163 "185.246.217.0/24", // AS210644
164 "193.5.250.0/24", // AS216246
165 "193.8.215.0/24", // AS210644
166 "193.29.224.0/23", // AS210644
167 "193.32.8.0/24", // AS210644
168 "193.33.153.0/24", // AS210644
169 "193.188.20.0/23", // AS210644
170 "193.188.22.0/24", // AS210644
171 "193.232.178.0/24", // AS210644
172 "193.233.88.0/22", // AS216246
173 "193.233.128.0/23", // AS210644
174 "193.233.133.0/24", // AS210644
175 "193.233.136.0/22", // AS210644
176 "193.233.161.0/24", // AS210644
177 "193.233.201.0/24", // AS210644
178 "193.233.208.0/22", // AS210644
179 "193.233.216.0/21", // AS216246
180 "193.233.230.0/23", // AS216246
181 "193.233.232.0/23", // AS210644
182 "193.233.244.0/22", // AS216246
183 "193.233.248.0/22", // AS216246
184 "194.26.229.0/24", // AS216246
185 "194.33.34.0/23", // AS210644
186 "194.59.186.0/24", // AS210644
187 "194.76.217.0/24", // AS210644
188 "194.113.106.0/24", // AS216246
189 "194.226.169.0/24", // AS210644
190 "195.74.90.0/24", // AS210644
191 "212.113.100.0/22", // AS210644
192 "212.113.106.0/24", // AS210644
193 "212.113.116.0/24", // AS210644
194 "212.113.119.0/24", // AS210644
195 "213.21.229.0/24", // AS210644
196 "213.21.233.0/24", // AS210644
197 "213.21.235.0/24", // AS210644
198 "213.21.242.0/24", // AS210644
199 "213.21.246.0/24", // AS210644
200 "213.21.250.0/23", // AS210644
201 "213.21.252.0/24", // AS210644
202 "213.21.254.0/24", // AS210644
203 "213.108.20.0/22", // AS210644
204 "213.165.32.0/21", // AS210644
205 "213.165.40.0/22", // AS210644
206 "213.165.44.0/24", // AS210644
207 "213.165.46.0/24", // AS210644
208 "213.165.48.0/23", // AS210644
209 "213.176.64.0/22", // AS210644
210 "213.176.112.0/22", // AS210644
211 "217.144.184.0/21", // AS210644, AS216246
212 "2a01:e5c0::/33", // AS210644, AS216246
213 "2a01:e5c0:8003::/48", // AS210644
214 "2a01:e5c0:8004::/48", // AS210644
215 "2a01:e5c0:8008::/48", // AS210644
216 "2a0b:4140::/32", // AS210644
217 "2a0e:b107:2780::/46", // AS210644
218 "2a0f:cdc6:2010::/44", // AS216246
219 "2a0f:cdc6:2020::/44", // AS216246
220 "2a0f:cdc6:5030::/44", // AS216246
221 "2a11:fc80::/29", // AS216246
222 "2a12:5940:1::/48", // AS210644
223 "2a12:5940:1000::/36", // AS210644
224 "2a12:5940:2000::/35", // AS210644
225 "2a12:5940:4000::/34", // AS210644
226 "2a12:5940:8000::/33", // AS210644, AS216246
227 "2a14:a084::/35", // AS210644, AS216246
228 "2a14:a084:2000::/36" // AS210644, AS216246
229 )
230 )
231attack_types:
232 - "Malware/Ransomware"
233 - "Credential Phishing"
234 - "BEC/Fraud"
235tactics_and_techniques:
236 - "Evasion"
237 - "Social engineering"
238detection_methods:
239 - "Header analysis"
240 - "Sender analysis"
241id: "2862e4bb-8520-5ba6-a392-c51dcb78a857"