Medium Severity

Observed IOC: Mail transiting bulletproof host - SmartApe

Description

Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694) as of 2026-08-05.

References

No references.

Sublime Security
Created Aug 5th, 2026 • Last updated Aug 5th, 2026
Source
type.inbound
and any(headers.ips,
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        beta.ip_in(.ip,
                   "5.188.60.0/24",
                   "5.188.166.0/24",
                   "31.177.108.0/22",
                   "77.91.89.0/24",
                   "91.219.148.0/22",
                   "91.219.149.0/24",
                   "94.198.50.0/23",
                   "94.198.52.0/22",
                   "109.238.92.0/23",
                   "152.89.216.0/22",
                   "152.89.218.0/24",
                   "165.197.216.0/24",
                   "178.255.126.0/23",
                   "185.9.144.0/22",
                   "185.9.145.0/24",
                   "185.130.248.0/22",
                   "185.217.128.0/24",
                   "188.127.224.0/20",
                   "188.127.240.0/22",
                   "188.127.241.0/24",
                   "188.127.244.0/23",
                   "188.127.248.0/22",
                   "188.127.253.0/24",
                   "188.127.254.0/23",
                   "209.142.100.0/24",
                   "213.171.16.0/21",
                   "213.171.18.0/24",
                   "213.171.19.0/24",
                   "217.21.53.0/24",
                   "2a06:dd00::/32",
                   "2a0b:2d80::/32",
                   "2a0e:fb42::/32",
                   "2a0f:6fc5:3e84::/48",
                   "2a0f:6fc5:a4ae::/48",
                   "2a0f:8447::/32"
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started