High Severity

Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Aeza Group

Description

Detects inbound mail whose Received-header IP path transits IP space announced by Aeza Group LLC, a bulletproof hosting provider designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-07-01 (CYBER4 / CAATSA-RUSSIA). IP ranges are the prefixes announced by Aeza's ASNs (AS210644, AS216246) as of 2026-08-05.

Sublime Security
Created Aug 5th, 2026 • Last updated Aug 5th, 2026
Source
type.inbound
and any(headers.ips,
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        beta.ip_in(.ip,
                   "5.182.86.0/24",
                   "5.182.87.0/24",
                   "45.80.228.0/24",
                   "45.80.229.0/24",
                   "45.80.230.0/24",
                   "45.80.231.0/24",
                   "45.136.175.0/24",
                   "45.136.228.0/24",
                   "45.137.60.0/24",
                   "45.137.81.0/24",
                   "45.140.13.0/24",
                   "45.141.177.0/24",
                   "45.144.54.0/23",
                   "45.145.13.0/24",
                   "45.145.14.0/24",
                   "45.146.131.0/24",
                   "45.150.32.0/24",
                   "45.150.33.0/24",
                   "45.151.101.0/24",
                   "45.151.102.0/24",
                   "45.152.198.0/24",
                   "45.155.71.0/24",
                   "46.226.160.0/23",
                   "46.226.162.0/23",
                   "46.226.164.0/23",
                   "46.226.166.0/23",
                   "62.60.148.0/24",
                   "62.60.149.0/24",
                   "62.60.150.0/24",
                   "62.60.151.0/24",
                   "62.60.156.0/24",
                   "62.60.157.0/24",
                   "62.60.158.0/24",
                   "62.60.159.0/24",
                   "62.60.186.0/24",
                   "62.60.228.0/24",
                   "62.60.229.0/24",
                   "62.60.230.0/24",
                   "62.60.231.0/24",
                   "62.60.236.0/24",
                   "62.60.237.0/24",
                   "62.60.238.0/24",
                   "62.60.239.0/24",
                   "77.73.131.0/24",
                   "77.73.135.0/24",
                   "77.110.96.0/24",
                   "77.110.97.0/24",
                   "77.110.98.0/24",
                   "77.110.99.0/24",
                   "77.110.100.0/24",
                   "77.110.101.0/24",
                   "77.110.102.0/24",
                   "77.110.103.0/24",
                   "77.110.104.0/24",
                   "77.110.105.0/24",
                   "77.110.106.0/24",
                   "77.110.108.0/24",
                   "77.110.110.0/24",
                   "77.110.116.0/24",
                   "77.110.118.0/24",
                   "77.110.120.0/24",
                   "77.110.121.0/24",
                   "77.221.136.0/22",
                   "77.221.140.0/22",
                   "77.221.148.0/24",
                   "77.221.149.0/24",
                   "77.221.151.0/24",
                   "77.221.152.0/23",
                   "77.221.154.0/23",
                   "77.221.156.0/23",
                   "77.221.158.0/23",
                   "77.232.142.0/23",
                   "78.153.130.0/24",
                   "79.137.184.0/24",
                   "79.137.192.0/24",
                   "79.137.194.0/23",
                   "79.137.196.0/22",
                   "79.137.202.0/23",
                   "79.137.204.0/23",
                   "79.137.206.0/24",
                   "79.137.207.0/24",
                   "79.137.248.0/24",
                   "80.85.241.0/24",
                   "81.19.137.0/24",
                   "82.117.84.0/24",
                   "82.117.87.0/24",
                   "84.22.148.0/24",
                   "84.22.149.0/24",
                   "84.22.150.0/24",
                   "84.22.151.0/24",
                   "85.192.24.0/24",
                   "85.192.25.0/24",
                   "85.192.26.0/24",
                   "85.192.27.0/24",
                   "85.192.28.0/24",
                   "85.192.29.0/24",
                   "85.192.30.0/24",
                   "85.192.31.0/24",
                   "85.192.37.0/24",
                   "85.192.38.0/24",
                   "85.192.40.0/23",
                   "85.192.42.0/24",
                   "85.192.56.0/24",
                   "85.192.60.0/24",
                   "85.192.61.0/24",
                   "85.192.63.0/24",
                   "89.22.224.0/21",
                   "89.22.232.0/21",
                   "89.169.32.0/23",
                   "89.169.34.0/23",
                   "89.169.52.0/23",
                   "89.169.54.0/23",
                   "89.185.85.0/24",
                   "89.208.96.0/24",
                   "89.208.97.0/24",
                   "89.208.103.0/24",
                   "89.208.104.0/22",
                   "89.208.113.0/24",
                   "91.103.140.0/24",
                   "91.108.240.0/24",
                   "91.108.241.0/24",
                   "91.108.242.0/24",
                   "91.184.240.0/24",
                   "91.184.241.0/24",
                   "91.184.242.0/24",
                   "91.184.243.0/24",
                   "92.246.136.0/24",
                   "92.246.137.0/24",
                   "92.246.138.0/24",
                   "92.246.139.0/24",
                   "94.228.162.0/24",
                   "94.228.163.0/24",
                   "94.228.164.0/24",
                   "94.228.165.0/24",
                   "94.228.169.0/24",
                   "94.228.170.0/24",
                   "94.228.172.0/24",
                   "95.163.152.0/24",
                   "95.163.153.0/24",
                   "95.163.176.0/24",
                   "95.181.160.0/24",
                   "95.181.162.0/24",
                   "95.181.167.0/24",
                   "95.181.174.0/24",
                   "95.181.175.0/24",
                   "104.238.29.0/24",
                   "109.107.181.0/24",
                   "109.107.189.0/24",
                   "109.107.190.0/24",
                   "109.120.132.0/23",
                   "109.120.134.0/23",
                   "109.120.138.0/24",
                   "109.120.139.0/24",
                   "109.120.140.0/24",
                   "109.120.149.0/24",
                   "109.120.150.0/24",
                   "109.120.151.0/24",
                   "109.120.152.0/24",
                   "109.120.155.0/24",
                   "109.120.156.0/23",
                   "109.120.176.0/23",
                   "109.120.178.0/23",
                   "109.120.184.0/23",
                   "109.120.186.0/24",
                   "109.120.187.0/24",
                   "109.172.94.0/24",
                   "109.172.95.0/24",
                   "138.124.13.0/24",
                   "138.124.14.0/24",
                   "138.124.18.0/24",
                   "138.124.24.0/24",
                   "138.124.25.0/24",
                   "138.124.26.0/24",
                   "138.124.29.0/24",
                   "138.124.34.0/24",
                   "138.124.35.0/24",
                   "138.124.49.0/24",
                   "138.124.50.0/24",
                   "138.124.51.0/24",
                   "138.124.52.0/24",
                   "138.124.53.0/24",
                   "138.124.54.0/24",
                   "138.124.55.0/24",
                   "138.124.58.0/24",
                   "138.124.59.0/24",
                   "138.124.61.0/24",
                   "138.124.78.0/24",
                   "138.124.89.0/24",
                   "138.124.90.0/24",
                   "138.124.91.0/24",
                   "138.124.92.0/24",
                   "138.124.93.0/24",
                   "138.124.99.0/24",
                   "138.124.101.0/24",
                   "138.124.102.0/24",
                   "138.124.103.0/24",
                   "138.124.108.0/24",
                   "138.124.109.0/24",
                   "138.124.110.0/24",
                   "138.124.112.0/24",
                   "138.124.113.0/24",
                   "138.124.114.0/24",
                   "138.124.115.0/24",
                   "138.124.116.0/24",
                   "138.124.117.0/24",
                   "138.124.118.0/24",
                   "138.124.119.0/24",
                   "138.124.124.0/24",
                   "138.124.127.0/24",
                   "147.45.40.0/24",
                   "147.45.41.0/24",
                   "147.45.42.0/24",
                   "147.45.43.0/24",
                   "147.45.68.0/24",
                   "147.45.69.0/24",
                   "147.45.70.0/24",
                   "147.45.71.0/24",
                   "147.45.72.0/23",
                   "147.45.74.0/23",
                   "147.45.76.0/23",
                   "147.45.78.0/23",
                   "176.124.198.0/23",
                   "176.124.202.0/24",
                   "176.124.203.0/24",
                   "176.124.204.0/24",
                   "176.124.205.0/24",
                   "176.124.206.0/24",
                   "176.124.207.0/24",
                   "176.124.220.0/24",
                   "176.124.221.0/24",
                   "176.124.222.0/24",
                   "178.20.208.0/24",
                   "178.20.209.0/24",
                   "178.159.94.0/24",
                   "178.236.246.0/24",
                   "178.236.247.0/24",
                   "178.236.248.0/24",
                   "178.236.250.0/24",
                   "178.236.251.0/24",
                   "178.236.252.0/24",
                   "178.236.255.0/24",
                   "185.68.244.0/24",
                   "185.96.80.0/24",
                   "185.103.100.0/24",
                   "185.103.101.0/24",
                   "185.103.102.0/24",
                   "185.103.103.0/24",
                   "185.104.151.0/24",
                   "185.125.100.0/24",
                   "185.125.101.0/24",
                   "185.125.102.0/24",
                   "185.125.103.0/24",
                   "185.197.74.0/24",
                   "185.221.196.0/24",
                   "185.221.199.0/24",
                   "185.230.143.0/24",
                   "185.246.217.0/24",
                   "193.8.215.0/24",
                   "193.29.224.0/24",
                   "193.29.225.0/24",
                   "193.32.8.0/24",
                   "193.33.153.0/24",
                   "193.188.20.0/24",
                   "193.188.21.0/24",
                   "193.188.22.0/24",
                   "193.232.178.0/24",
                   "193.233.88.0/24",
                   "193.233.89.0/24",
                   "193.233.90.0/24",
                   "193.233.91.0/24",
                   "193.233.128.0/24",
                   "193.233.129.0/24",
                   "193.233.133.0/24",
                   "193.233.136.0/22",
                   "193.233.136.0/24",
                   "193.233.137.0/24",
                   "193.233.138.0/24",
                   "193.233.139.0/24",
                   "193.233.161.0/24",
                   "193.233.201.0/24",
                   "193.233.208.0/22",
                   "193.233.208.0/24",
                   "193.233.209.0/24",
                   "193.233.210.0/24",
                   "193.233.211.0/24",
                   "193.233.216.0/24",
                   "193.233.217.0/24",
                   "193.233.218.0/24",
                   "193.233.219.0/24",
                   "193.233.220.0/24",
                   "193.233.221.0/24",
                   "193.233.222.0/24",
                   "193.233.223.0/24",
                   "193.233.230.0/24",
                   "193.233.231.0/24",
                   "193.233.232.0/24",
                   "193.233.233.0/24",
                   "193.233.244.0/24",
                   "193.233.245.0/24",
                   "193.233.246.0/24",
                   "193.233.247.0/24",
                   "193.233.248.0/24",
                   "193.233.249.0/24",
                   "193.233.250.0/24",
                   "193.233.251.0/24",
                   "194.26.229.0/24",
                   "194.33.34.0/24",
                   "194.33.35.0/24",
                   "194.59.186.0/24",
                   "194.76.217.0/24",
                   "194.113.106.0/24",
                   "194.226.169.0/24",
                   "195.74.90.0/24",
                   "212.113.100.0/24",
                   "212.113.101.0/24",
                   "212.113.102.0/24",
                   "212.113.103.0/24",
                   "212.113.106.0/24",
                   "212.113.116.0/24",
                   "212.113.119.0/24",
                   "213.21.229.0/24",
                   "213.21.233.0/24",
                   "213.21.235.0/24",
                   "213.21.242.0/24",
                   "213.21.246.0/24",
                   "213.21.250.0/24",
                   "213.21.251.0/24",
                   "213.21.252.0/24",
                   "213.21.254.0/24",
                   "213.108.20.0/24",
                   "213.108.21.0/24",
                   "213.108.22.0/24",
                   "213.108.23.0/24",
                   "213.165.32.0/24",
                   "213.165.33.0/24",
                   "213.165.34.0/24",
                   "213.165.35.0/24",
                   "213.165.36.0/24",
                   "213.165.37.0/24",
                   "213.165.38.0/24",
                   "213.165.39.0/24",
                   "213.165.40.0/24",
                   "213.165.41.0/24",
                   "213.165.42.0/24",
                   "213.165.43.0/24",
                   "213.165.44.0/24",
                   "213.165.46.0/24",
                   "213.165.48.0/24",
                   "213.165.49.0/24",
                   "213.176.64.0/24",
                   "213.176.65.0/24",
                   "213.176.66.0/24",
                   "213.176.67.0/24",
                   "213.176.112.0/24",
                   "213.176.113.0/24",
                   "213.176.114.0/24",
                   "213.176.115.0/24",
                   "217.144.184.0/24",
                   "217.144.185.0/24",
                   "217.144.186.0/24",
                   "217.144.187.0/24",
                   "217.144.188.0/24",
                   "217.144.189.0/24",
                   "217.144.190.0/24",
                   "217.144.191.0/24",
                   "2a01:e5c0::/36",
                   "2a01:e5c0:1000::/36",
                   "2a01:e5c0:2000::/36",
                   "2a01:e5c0:3000::/36",
                   "2a01:e5c0:4000::/36",
                   "2a01:e5c0:5000::/36",
                   "2a01:e5c0:6000::/36",
                   "2a01:e5c0:7000::/36",
                   "2a01:e5c0:8003::/48",
                   "2a01:e5c0:8004::/48",
                   "2a01:e5c0:8008::/48",
                   "2a0b:4140:1000::/36",
                   "2a0b:4140:2000::/36",
                   "2a0b:4140:3000::/36",
                   "2a0b:4140:4000::/36",
                   "2a0b:4140:5000::/36",
                   "2a0b:4140:6000::/36",
                   "2a0b:4140:7000::/36",
                   "2a0b:4140:7028::/48",
                   "2a0b:4140:9000::/36",
                   "2a0b:4140:a000::/36",
                   "2a0b:4140:b000::/36",
                   "2a0b:4140:c000::/36",
                   "2a0b:4140:d000::/36",
                   "2a0b:4140:e000::/36",
                   "2a0b:4140:f000::/36",
                   "2a0e:b107:2780::/46",
                   "2a0f:cdc6:2010::/44",
                   "2a0f:cdc6:2020::/44",
                   "2a0f:cdc6:5030::/44",
                   "2a11:fc80::/30",
                   "2a11:fc84::/30",
                   "2a12:5940:1::/48",
                   "2a12:5940:1000::/36",
                   "2a12:5940:2000::/36",
                   "2a12:5940:3000::/36",
                   "2a12:5940:4000::/36",
                   "2a12:5940:5000::/36",
                   "2a12:5940:6000::/36",
                   "2a12:5940:7000::/36",
                   "2a12:5940:8000::/36",
                   "2a12:5940:9000::/36",
                   "2a12:5940:a000::/36",
                   "2a12:5940:b000::/36",
                   "2a12:5940:c000::/36",
                   "2a12:5940:d000::/36",
                   "2a12:5940:e000::/36",
                   "2a12:5940:f000::/36",
                   "2a14:a084::/36",
                   "2a14:a084:1000::/36",
                   "2a14:a084:2000::/36"
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started