EXPLORE
Sign In
← Back to Explore
sublimemediumRule

Observed IOC: Mail transiting bulletproof host - SmartApe

Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694).

MITRE ATT&CK

T1566.001T1204.002T1486T1566T1566.002T1598T1534T1656T1036T1027
defense-evasioninitial-access

Detection Query

type.inbound
and any(headers.ips,
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        beta.ip_in(.ip,
                   "31.177.108.0/22", // AS56694
                   "77.91.89.0/24", // AS56694
                   "91.219.148.0/22", // AS56694
                   "94.198.50.0/23", // AS56694
                   "94.198.52.0/22", // AS56694
                   "109.238.92.0/23", // AS56694
                   "152.89.216.0/22", // AS56694
                   "178.255.126.0/23", // AS56694
                   "185.9.144.0/22", // AS56694
                   "185.130.248.0/22", // AS56694
                   "185.217.128.0/24", // AS56694
                   "188.127.224.0/20", // AS56694
                   "188.127.240.0/22", // AS56694
                   "188.127.244.0/23", // AS56694
                   "188.127.248.0/22", // AS56694
                   "188.127.253.0/24", // AS56694
                   "188.127.254.0/23", // AS56694
                   "209.142.100.0/24", // AS56694
                   "213.171.16.0/21", // AS56694
                   "217.21.53.0/24", // AS56694
                   "2a06:dd00::/32", // AS56694
                   "2a0b:2d80::/32", // AS56694
                   "2a0e:fb42::/32", // AS56694
                   "2a0f:6fc5:3e84::/48", // AS56694
                   "2a0f:6fc5:a4ae::/48", // AS56694
                   "2a0f:8447::/32" // AS56694
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

email
Raw Content
name: "Observed IOC: Mail transiting bulletproof host - SmartApe"
description: "Detects inbound mail whose IP space is announced by SmartApe (SmartApe LLC), a Russia-based hosting provider widely reported for abuse-tolerant / bulletproof hosting. IP ranges are the prefixes announced by SmartApe's ASN (AS56694)."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(headers.ips,
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          beta.ip_in(.ip,
                     "31.177.108.0/22", // AS56694
                     "77.91.89.0/24", // AS56694
                     "91.219.148.0/22", // AS56694
                     "94.198.50.0/23", // AS56694
                     "94.198.52.0/22", // AS56694
                     "109.238.92.0/23", // AS56694
                     "152.89.216.0/22", // AS56694
                     "178.255.126.0/23", // AS56694
                     "185.9.144.0/22", // AS56694
                     "185.130.248.0/22", // AS56694
                     "185.217.128.0/24", // AS56694
                     "188.127.224.0/20", // AS56694
                     "188.127.240.0/22", // AS56694
                     "188.127.244.0/23", // AS56694
                     "188.127.248.0/22", // AS56694
                     "188.127.253.0/24", // AS56694
                     "188.127.254.0/23", // AS56694
                     "209.142.100.0/24", // AS56694
                     "213.171.16.0/21", // AS56694
                     "217.21.53.0/24", // AS56694
                     "2a06:dd00::/32", // AS56694
                     "2a0b:2d80::/32", // AS56694
                     "2a0e:fb42::/32", // AS56694
                     "2a0f:6fc5:3e84::/48", // AS56694
                     "2a0f:6fc5:a4ae::/48", // AS56694
                     "2a0f:8447::/32" // AS56694
          )
  )
attack_types:
  - "Malware/Ransomware"
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
id: "c618a080-57ac-5fc4-be61-d04db5b03ed5"