High Severity

Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Media Land / ML Cloud

Labels

Malware/Ransomware

Credential Phishing

Description

Detects inbound mail whose Received-header IP path transits IP space announced by Media Land LLC or its sister company ML Cloud LLC, designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-11-19 (E.O. 13694) for providing bulletproof hosting infrastructure to LockBit, BlackSuit, and Play ransomware operations and DDoS attacks against U.S. critical infrastructure. IP ranges are the prefixes announced by Media Land's ASNs (AS206728, AS215376).

References

https://home.treasury.gov/news/press-releases/sb0319

https://www.justice.gov/usao-ndoh/pr/three-russian-nationals-indicted-international-cybercrimes-resulting-more-62m-losses

Sublime Security

Created Sep 24th, 2026 • Last updated Sep 24th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(headers.ips,
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        beta.ip_in(.ip,
                   "45.141.85.0/24", // AS206728
                   "91.220.163.0/24", // AS206728
                   "176.98.187.0/24", // AS215376
                   "2a0b:7ec0:1320::/48", // AS206728
                   "2a0b:7ec0:7701::/48" // AS206728
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.