Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group
Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246).
Sublime rule (View on GitHub)
1name: "Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group"
2description: "Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246)."
3references:
4 - "https://ofac.treasury.gov/recent-actions/20250701"
5type: "rule"
6severity: "high"
7source: |
8 // Aeza Group — OFAC SDN 2025-07-01 [CYBER4] — ranges resolved 2026-08-10
9 type.inbound
10 and any(headers.ips,
11 //
12 // This rule makes use of a beta feature and is subject to change without notice
13 // using the beta feature in custom rules is not suggested until it has been formally released
14 //
15 beta.ip_in(.ip,
16 "5.182.86.0/23",
17 "45.80.228.0/22",
18 "45.136.175.0/24",
19 "45.136.228.0/24",
20 "45.137.60.0/24",
21 "45.137.81.0/24",
22 "45.140.13.0/24",
23 "45.141.177.0/24",
24 "45.144.54.0/23",
25 "45.145.13.0/24",
26 "45.145.14.0/24",
27 "45.146.131.0/24",
28 "45.150.32.0/23",
29 "45.151.101.0/24",
30 "45.151.102.0/24",
31 "45.152.198.0/24",
32 "45.155.71.0/24",
33 "46.226.160.0/21",
34 "62.60.148.0/22",
35 "62.60.156.0/22",
36 "62.60.186.0/24",
37 "62.60.228.0/22",
38 "62.60.236.0/22",
39 "77.73.131.0/24",
40 "77.73.135.0/24",
41 "77.110.96.0/21",
42 "77.110.104.0/23",
43 "77.110.106.0/24",
44 "77.110.108.0/24",
45 "77.110.110.0/24",
46 "77.110.116.0/24",
47 "77.110.118.0/24",
48 "77.110.120.0/23",
49 "77.221.136.0/21",
50 "77.221.148.0/23",
51 "77.221.151.0/24",
52 "77.221.152.0/21",
53 "77.232.142.0/23",
54 "78.153.130.0/24",
55 "79.137.184.0/24",
56 "79.137.192.0/24",
57 "79.137.194.0/23",
58 "79.137.196.0/22",
59 "79.137.202.0/23",
60 "79.137.204.0/22",
61 "79.137.248.0/24",
62 "80.85.241.0/24",
63 "81.19.137.0/24",
64 "82.117.84.0/24",
65 "82.117.87.0/24",
66 "84.22.148.0/22",
67 "85.192.24.0/21",
68 "85.192.37.0/24",
69 "85.192.38.0/24",
70 "85.192.40.0/23",
71 "85.192.42.0/24",
72 "85.192.56.0/24",
73 "85.192.60.0/23",
74 "85.192.63.0/24",
75 "89.22.224.0/20",
76 "89.169.32.0/22",
77 "89.169.52.0/22",
78 "89.185.85.0/24",
79 "89.208.96.0/23",
80 "89.208.103.0/24",
81 "89.208.104.0/22",
82 "89.208.113.0/24",
83 "91.103.140.0/24",
84 "91.108.240.0/23",
85 "91.108.242.0/24",
86 "91.184.240.0/22",
87 "92.246.136.0/22",
88 "94.228.162.0/23",
89 "94.228.164.0/23",
90 "94.228.169.0/24",
91 "94.228.170.0/24",
92 "94.228.172.0/24",
93 "95.163.152.0/23",
94 "95.163.176.0/24",
95 "95.181.160.0/24",
96 "95.181.162.0/24",
97 "95.181.167.0/24",
98 "95.181.174.0/23",
99 "104.238.29.0/24",
100 "109.107.181.0/24",
101 "109.107.189.0/24",
102 "109.107.190.0/24",
103 "109.120.132.0/22",
104 "109.120.138.0/23",
105 "109.120.140.0/24",
106 "109.120.149.0/24",
107 "109.120.150.0/23",
108 "109.120.152.0/24",
109 "109.120.155.0/24",
110 "109.120.156.0/23",
111 "109.120.176.0/22",
112 "109.120.184.0/22",
113 "109.172.94.0/23",
114 "138.124.13.0/24",
115 "138.124.14.0/24",
116 "138.124.18.0/24",
117 "138.124.24.0/23",
118 "138.124.26.0/24",
119 "138.124.29.0/24",
120 "138.124.34.0/23",
121 "138.124.49.0/24",
122 "138.124.50.0/23",
123 "138.124.52.0/22",
124 "138.124.58.0/23",
125 "138.124.61.0/24",
126 "138.124.78.0/24",
127 "138.124.89.0/24",
128 "138.124.90.0/23",
129 "138.124.92.0/23",
130 "138.124.99.0/24",
131 "138.124.101.0/24",
132 "138.124.102.0/23",
133 "138.124.108.0/23",
134 "138.124.110.0/24",
135 "138.124.112.0/21",
136 "138.124.124.0/24",
137 "138.124.127.0/24",
138 "147.45.40.0/22",
139 "147.45.68.0/22",
140 "147.45.72.0/21",
141 "176.124.198.0/23",
142 "176.124.202.0/23",
143 "176.124.204.0/22",
144 "176.124.220.0/23",
145 "176.124.222.0/24",
146 "178.20.208.0/23",
147 "178.159.94.0/24",
148 "178.236.246.0/23",
149 "178.236.248.0/24",
150 "178.236.250.0/23",
151 "178.236.252.0/24",
152 "178.236.255.0/24",
153 "185.68.244.0/24",
154 "185.96.80.0/24",
155 "185.103.100.0/22",
156 "185.104.151.0/24",
157 "185.125.100.0/22",
158 "185.197.74.0/24",
159 "185.221.196.0/24",
160 "185.221.199.0/24",
161 "185.230.143.0/24",
162 "185.246.217.0/24",
163 "193.8.215.0/24",
164 "193.29.224.0/23",
165 "193.32.8.0/24",
166 "193.33.153.0/24",
167 "193.188.20.0/23",
168 "193.188.22.0/24",
169 "193.232.178.0/24",
170 "193.233.88.0/22",
171 "193.233.128.0/23",
172 "193.233.133.0/24",
173 "193.233.136.0/22",
174 "193.233.161.0/24",
175 "193.233.201.0/24",
176 "193.233.208.0/22",
177 "193.233.216.0/21",
178 "193.233.230.0/23",
179 "193.233.232.0/23",
180 "193.233.244.0/22",
181 "193.233.248.0/22",
182 "194.26.229.0/24",
183 "194.33.34.0/23",
184 "194.59.186.0/24",
185 "194.76.217.0/24",
186 "194.113.106.0/24",
187 "194.226.169.0/24",
188 "195.74.90.0/24",
189 "212.113.100.0/22",
190 "212.113.106.0/24",
191 "212.113.116.0/24",
192 "212.113.119.0/24",
193 "213.21.229.0/24",
194 "213.21.233.0/24",
195 "213.21.235.0/24",
196 "213.21.242.0/24",
197 "213.21.246.0/24",
198 "213.21.250.0/23",
199 "213.21.252.0/24",
200 "213.21.254.0/24",
201 "213.108.20.0/22",
202 "213.165.32.0/21",
203 "213.165.40.0/22",
204 "213.165.44.0/24",
205 "213.165.46.0/24",
206 "213.165.48.0/23",
207 "213.176.64.0/22",
208 "213.176.112.0/22",
209 "217.144.184.0/21",
210 "2a01:e5c0::/33",
211 "2a01:e5c0:8003::/48",
212 "2a01:e5c0:8004::/48",
213 "2a01:e5c0:8008::/48",
214 "2a0b:4140:1000::/36",
215 "2a0b:4140:2000::/35",
216 "2a0b:4140:4000::/34",
217 "2a0b:4140:9000::/36",
218 "2a0b:4140:a000::/35",
219 "2a0b:4140:c000::/34",
220 "2a0e:b107:2780::/46",
221 "2a0f:cdc6:2010::/44",
222 "2a0f:cdc6:2020::/44",
223 "2a0f:cdc6:5030::/44",
224 "2a11:fc80::/29",
225 "2a12:5940:1::/48",
226 "2a12:5940:1000::/36",
227 "2a12:5940:2000::/35",
228 "2a12:5940:4000::/34",
229 "2a12:5940:8000::/33",
230 "2a14:a084::/35",
231 "2a14:a084:2000::/36"
232 )
233 )
234attack_types:
235 - "Malware/Ransomware"
236 - "Credential Phishing"
237 - "BEC/Fraud"
238tactics_and_techniques:
239 - "Evasion"
240 - "Social engineering"
241detection_methods:
242 - "Header analysis"
243 - "Sender analysis"
244id: "2862e4bb-8520-5ba6-a392-c51dcb78a857"