Medium Severity

Observed IOC: Mail transiting bulletproof host - SmartApe

Labels

Malware/Ransomware

Credential Phishing

Description

Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694).

References

No references.

Sublime Security

Created Aug 5th, 2026 • Last updated Oct 8th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(headers.ips,
        ip.in_range(.,
                    "31.177.108.0/22", // AS56694
                    "77.91.89.0/24", // AS56694
                    "91.219.148.0/22", // AS56694
                    "94.198.50.0/23", // AS56694
                    "94.198.52.0/22", // AS56694
                    "109.238.92.0/23", // AS56694
                    "152.89.216.0/22", // AS56694
                    "178.255.126.0/23", // AS56694
                    "185.9.144.0/22", // AS56694
                    "185.130.248.0/22", // AS56694
                    "185.217.128.0/24", // AS56694
                    "188.127.224.0/20", // AS56694
                    "188.127.240.0/22", // AS56694
                    "188.127.244.0/23", // AS56694
                    "188.127.248.0/22", // AS56694
                    "188.127.253.0/24", // AS56694
                    "188.127.254.0/23", // AS56694
                    "209.142.100.0/24", // AS56694
                    "213.171.16.0/21", // AS56694
                    "217.21.53.0/24", // AS56694
                    "2a06:dd00::/32", // AS56694
                    "2a0b:2d80::/32", // AS56694
                    "2a0e:fb42::/32", // AS56694
                    "2a0f:6fc5:3e84::/48", // AS56694
                    "2a0f:6fc5:a4ae::/48", // AS56694
                    "2a0f:8447::/32" // AS56694
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.