Observed IOC: Mail transiting bulletproof host - SmartApe

calendar Aug 10, 2026  ·
Share on: linkedin copy

Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694).

Sublime rule (View on GitHub)

 1name: "Observed IOC: Mail transiting bulletproof host - SmartApe"
 2description: "Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694)."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  // SmartApe LLC — abuse-tolerant/bulletproof host (not sanctioned) — ranges resolved 2026-08-10
 7  type.inbound
 8  and any(headers.ips,
 9          //
10          // This rule makes use of a beta feature and is subject to change without notice
11          // using the beta feature in custom rules is not suggested until it has been formally released
12          //
13          beta.ip_in(.ip,
14                     "5.188.60.0/24",
15                     "5.188.166.0/24",
16                     "31.177.108.0/22",
17                     "77.91.89.0/24",
18                     "91.219.148.0/22",
19                     "94.198.50.0/23",
20                     "94.198.52.0/22",
21                     "109.238.92.0/23",
22                     "152.89.216.0/22",
23                     "165.197.216.0/24",
24                     "178.255.126.0/23",
25                     "185.9.144.0/22",
26                     "185.130.248.0/22",
27                     "185.217.128.0/24",
28                     "188.127.224.0/20",
29                     "188.127.240.0/22",
30                     "188.127.244.0/23",
31                     "188.127.248.0/22",
32                     "188.127.253.0/24",
33                     "188.127.254.0/23",
34                     "209.142.100.0/24",
35                     "213.171.16.0/21",
36                     "217.21.53.0/24",
37                     "2a06:dd00::/32",
38                     "2a0b:2d80::/32",
39                     "2a0e:fb42::/32",
40                     "2a0f:6fc5:3e84::/48",
41                     "2a0f:6fc5:a4ae::/48",
42                     "2a0f:8447::/32"
43          )
44  )  
45attack_types:
46  - "Malware/Ransomware"
47  - "Credential Phishing"
48  - "BEC/Fraud"
49tactics_and_techniques:
50  - "Evasion"
51  - "Social engineering"
52detection_methods:
53  - "Header analysis"
54  - "Sender analysis"
55id: "c618a080-57ac-5fc4-be61-d04db5b03ed5"
to-top