High Severity

Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group

Labels

Malware/Ransomware
Credential Phishing
BEC/Fraud
Evasion
Social engineering
Header analysis
Sender analysis

Description

Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246).

References

Sublime Security
Created Aug 5th, 2026 • Last updated Aug 20th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(headers.ips,
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        beta.ip_in(.ip,
                   "5.182.86.0/23", // AS210644
                   "45.80.228.0/22", // AS210644
                   "45.136.175.0/24", // AS210644
                   "45.136.228.0/24", // AS210644
                   "45.137.60.0/24", // AS210644
                   "45.137.81.0/24", // AS210644
                   "45.140.13.0/24", // AS210644
                   "45.141.177.0/24", // AS210644
                   "45.144.54.0/23", // AS210644
                   "45.145.13.0/24", // AS210644
                   "45.145.14.0/24", // AS210644
                   "45.146.131.0/24", // AS216246
                   "45.150.32.0/23", // AS210644
                   "45.151.101.0/24", // AS216246
                   "45.151.102.0/24", // AS216246
                   "45.152.198.0/24", // AS216246
                   "45.155.71.0/24", // AS210644
                   "46.226.160.0/21", // AS210644
                   "62.60.148.0/22", // AS210644
                   "62.60.156.0/22", // AS210644
                   "62.60.186.0/24", // AS210644
                   "62.60.228.0/22", // AS210644
                   "62.60.236.0/22", // AS210644
                   "77.73.131.0/24", // AS210644
                   "77.73.135.0/24", // AS210644
                   "77.110.96.0/21", // AS210644
                   "77.110.104.0/23", // AS216246
                   "77.110.106.0/24", // AS210644
                   "77.110.108.0/24", // AS210644
                   "77.110.110.0/24", // AS210644
                   "77.110.116.0/24", // AS210644
                   "77.110.118.0/24", // AS210644
                   "77.110.120.0/23", // AS210644
                   "77.221.136.0/21", // AS210644
                   "77.221.148.0/23", // AS210644
                   "77.221.151.0/24", // AS216246
                   "77.221.152.0/21", // AS210644
                   "77.232.142.0/23", // AS210644
                   "78.153.130.0/24", // AS210644
                   "79.137.184.0/24", // AS210644
                   "79.137.192.0/24", // AS216246
                   "79.137.194.0/23", // AS210644
                   "79.137.196.0/22", // AS210644
                   "79.137.202.0/23", // AS210644
                   "79.137.204.0/22", // AS210644
                   "79.137.248.0/24", // AS210644
                   "80.85.241.0/24", // AS210644
                   "81.19.137.0/24", // AS210644
                   "82.117.84.0/24", // AS210644
                   "82.117.87.0/24", // AS216246
                   "84.22.148.0/22", // AS210644
                   "85.192.24.0/21", // AS210644, AS216246
                   "85.192.37.0/24", // AS210644
                   "85.192.38.0/24", // AS210644
                   "85.192.40.0/23", // AS210644
                   "85.192.42.0/24", // AS210644
                   "85.192.56.0/24", // AS216246
                   "85.192.60.0/23", // AS210644
                   "85.192.63.0/24", // AS210644
                   "89.22.224.0/20", // AS210644
                   "89.169.32.0/22", // AS210644
                   "89.169.52.0/22", // AS210644
                   "89.185.85.0/24", // AS210644
                   "89.208.96.0/23", // AS210644
                   "89.208.103.0/24", // AS210644
                   "89.208.104.0/22", // AS210644
                   "89.208.113.0/24", // AS210644
                   "91.103.140.0/24", // AS210644
                   "91.108.240.0/23", // AS210644
                   "91.108.242.0/24", // AS210644
                   "91.184.240.0/22", // AS210644
                   "92.246.136.0/22", // AS210644, AS216246
                   "94.228.162.0/23", // AS210644
                   "94.228.164.0/23", // AS210644
                   "94.228.169.0/24", // AS210644
                   "94.228.170.0/24", // AS210644
                   "94.228.172.0/24", // AS210644
                   "95.163.152.0/23", // AS210644
                   "95.163.176.0/24", // AS210644
                   "95.181.160.0/24", // AS210644
                   "95.181.162.0/24", // AS210644
                   "95.181.167.0/24", // AS210644
                   "95.181.174.0/23", // AS210644
                   "104.238.29.0/24", // AS210644
                   "109.107.181.0/24", // AS210644
                   "109.107.189.0/24", // AS216246
                   "109.107.190.0/24", // AS210644
                   "109.120.132.0/22", // AS210644
                   "109.120.138.0/23", // AS210644
                   "109.120.140.0/24", // AS210644
                   "109.120.149.0/24", // AS210644
                   "109.120.150.0/23", // AS210644
                   "109.120.152.0/24", // AS216246
                   "109.120.155.0/24", // AS210644
                   "109.120.156.0/23", // AS210644
                   "109.120.176.0/22", // AS210644
                   "109.120.184.0/22", // AS210644
                   "109.172.94.0/23", // AS210644
                   "138.124.13.0/24", // AS216246
                   "138.124.14.0/24", // AS216246
                   "138.124.18.0/24", // AS210644
                   "138.124.24.0/23", // AS210644
                   "138.124.26.0/24", // AS210644
                   "138.124.29.0/24", // AS210644
                   "138.124.34.0/23", // AS210644
                   "138.124.49.0/24", // AS210644
                   "138.124.50.0/23", // AS210644
                   "138.124.52.0/22", // AS210644
                   "138.124.58.0/23", // AS210644
                   "138.124.61.0/24", // AS210644
                   "138.124.78.0/24", // AS210644
                   "138.124.89.0/24", // AS210644
                   "138.124.90.0/23", // AS210644
                   "138.124.92.0/23", // AS210644
                   "138.124.99.0/24", // AS210644
                   "138.124.101.0/24", // AS210644
                   "138.124.102.0/23", // AS210644
                   "138.124.108.0/23", // AS210644
                   "138.124.110.0/24", // AS210644
                   "138.124.112.0/21", // AS210644
                   "138.124.124.0/24", // AS210644
                   "138.124.127.0/24", // AS210644
                   "147.45.40.0/22", // AS210644
                   "147.45.68.0/22", // AS210644
                   "147.45.72.0/21", // AS210644
                   "176.124.198.0/23", // AS210644
                   "176.124.202.0/23", // AS210644
                   "176.124.204.0/22", // AS210644
                   "176.124.220.0/23", // AS210644
                   "176.124.222.0/24", // AS216246
                   "178.20.208.0/23", // AS210644, AS216246
                   "178.159.94.0/24", // AS216246
                   "178.236.246.0/23", // AS210644
                   "178.236.248.0/24", // AS210644
                   "178.236.250.0/23", // AS210644, AS216246
                   "178.236.252.0/24", // AS210644
                   "178.236.255.0/24", // AS210644
                   "185.68.244.0/24", // AS210644
                   "185.96.80.0/24", // AS216246
                   "185.103.100.0/22", // AS210644, AS216246
                   "185.104.151.0/24", // AS210644
                   "185.125.100.0/22", // AS210644
                   "185.197.74.0/24", // AS210644
                   "185.221.196.0/24", // AS210644
                   "185.221.199.0/24", // AS216246
                   "185.230.143.0/24", // AS210644
                   "185.246.217.0/24", // AS210644
                   "193.8.215.0/24", // AS210644
                   "193.29.224.0/23", // AS210644
                   "193.32.8.0/24", // AS210644
                   "193.33.153.0/24", // AS210644
                   "193.188.20.0/23", // AS210644
                   "193.188.22.0/24", // AS210644
                   "193.232.178.0/24", // AS210644
                   "193.233.88.0/22", // AS216246
                   "193.233.128.0/23", // AS210644
                   "193.233.133.0/24", // AS210644
                   "193.233.136.0/22", // AS210644
                   "193.233.161.0/24", // AS210644
                   "193.233.201.0/24", // AS210644
                   "193.233.208.0/22", // AS210644
                   "193.233.216.0/21", // AS216246
                   "193.233.230.0/23", // AS216246
                   "193.233.232.0/23", // AS210644
                   "193.233.244.0/22", // AS216246
                   "193.233.248.0/22", // AS216246
                   "194.26.229.0/24", // AS216246
                   "194.33.34.0/23", // AS210644
                   "194.59.186.0/24", // AS210644
                   "194.76.217.0/24", // AS210644
                   "194.113.106.0/24", // AS216246
                   "194.226.169.0/24", // AS210644
                   "195.74.90.0/24", // AS210644
                   "212.113.100.0/22", // AS210644
                   "212.113.106.0/24", // AS210644
                   "212.113.116.0/24", // AS210644
                   "212.113.119.0/24", // AS210644
                   "213.21.229.0/24", // AS210644
                   "213.21.233.0/24", // AS210644
                   "213.21.235.0/24", // AS210644
                   "213.21.242.0/24", // AS210644
                   "213.21.246.0/24", // AS210644
                   "213.21.250.0/23", // AS210644
                   "213.21.252.0/24", // AS210644
                   "213.21.254.0/24", // AS210644
                   "213.108.20.0/22", // AS210644
                   "213.165.32.0/21", // AS210644
                   "213.165.40.0/22", // AS210644
                   "213.165.44.0/24", // AS210644
                   "213.165.46.0/24", // AS210644
                   "213.165.48.0/23", // AS210644
                   "213.176.64.0/22", // AS210644
                   "213.176.112.0/22", // AS210644
                   "217.144.184.0/21", // AS210644, AS216246
                   "2a01:e5c0::/33", // AS210644, AS216246
                   "2a01:e5c0:8003::/48", // AS210644
                   "2a01:e5c0:8004::/48", // AS210644
                   "2a01:e5c0:8008::/48", // AS210644
                   "2a0b:4140:1000::/36", // AS210644
                   "2a0b:4140:2000::/35", // AS210644
                   "2a0b:4140:4000::/34", // AS210644
                   "2a0b:4140:9000::/36", // AS210644
                   "2a0b:4140:a000::/35", // AS210644
                   "2a0b:4140:c000::/34", // AS210644
                   "2a0e:b107:2780::/46", // AS210644
                   "2a0f:cdc6:2010::/44", // AS216246
                   "2a0f:cdc6:2020::/44", // AS216246
                   "2a0f:cdc6:5030::/44", // AS216246
                   "2a11:fc80::/29", // AS216246
                   "2a12:5940:1::/48", // AS210644
                   "2a12:5940:1000::/36", // AS210644
                   "2a12:5940:2000::/35", // AS210644
                   "2a12:5940:4000::/34", // AS210644
                   "2a12:5940:8000::/33", // AS210644, AS216246
                   "2a14:a084::/35", // AS210644
                   "2a14:a084:2000::/36" // AS210644
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started