type.inbound
and any(headers.ips,
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
beta.ip_in(.ip,
"5.188.60.0/24",
"5.188.166.0/24",
"31.177.108.0/22",
"77.91.89.0/24",
"91.219.148.0/22",
"91.219.149.0/24",
"94.198.50.0/23",
"94.198.52.0/22",
"109.238.92.0/23",
"152.89.216.0/22",
"152.89.218.0/24",
"165.197.216.0/24",
"178.255.126.0/23",
"185.9.144.0/22",
"185.9.145.0/24",
"185.130.248.0/22",
"185.217.128.0/24",
"188.127.224.0/20",
"188.127.240.0/22",
"188.127.241.0/24",
"188.127.244.0/23",
"188.127.248.0/22",
"188.127.253.0/24",
"188.127.254.0/23",
"209.142.100.0/24",
"213.171.16.0/21",
"213.171.18.0/24",
"213.171.19.0/24",
"217.21.53.0/24",
"2a06:dd00::/32",
"2a0b:2d80::/32",
"2a0e:fb42::/32",
"2a0f:6fc5:3e84::/48",
"2a0f:6fc5:a4ae::/48",
"2a0f:8447::/32"
)
)
Playground
Test against your own EMLs or sample data.