Observed IOC: Mail transiting bulletproof host - SmartApe

calendar Oct 8, 2026  ·
Share on: linkedin copy

Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694).

Sublime rule (View on GitHub)

 1name: "Observed IOC: Mail transiting bulletproof host - SmartApe"
 2description: "Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694)."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(headers.ips,
 8          ip.in_range(.,
 9                      "31.177.108.0/22", // AS56694
10                      "77.91.89.0/24", // AS56694
11                      "91.219.148.0/22", // AS56694
12                      "94.198.50.0/23", // AS56694
13                      "94.198.52.0/22", // AS56694
14                      "109.238.92.0/23", // AS56694
15                      "152.89.216.0/22", // AS56694
16                      "178.255.126.0/23", // AS56694
17                      "185.9.144.0/22", // AS56694
18                      "185.130.248.0/22", // AS56694
19                      "185.217.128.0/24", // AS56694
20                      "188.127.224.0/20", // AS56694
21                      "188.127.240.0/22", // AS56694
22                      "188.127.244.0/23", // AS56694
23                      "188.127.248.0/22", // AS56694
24                      "188.127.253.0/24", // AS56694
25                      "188.127.254.0/23", // AS56694
26                      "209.142.100.0/24", // AS56694
27                      "213.171.16.0/21", // AS56694
28                      "217.21.53.0/24", // AS56694
29                      "2a06:dd00::/32", // AS56694
30                      "2a0b:2d80::/32", // AS56694
31                      "2a0e:fb42::/32", // AS56694
32                      "2a0f:6fc5:3e84::/48", // AS56694
33                      "2a0f:6fc5:a4ae::/48", // AS56694
34                      "2a0f:8447::/32" // AS56694
35          )
36  )  
37attack_types:
38  - "Malware/Ransomware"
39  - "Credential Phishing"
40  - "BEC/Fraud"
41tactics_and_techniques:
42  - "Evasion"
43  - "Social engineering"
44detection_methods:
45  - "Header analysis"
46  - "Sender analysis"
47id: "c618a080-57ac-5fc4-be61-d04db5b03ed5"
to-top