Technical summary: This rule detects inbound email messages whose source IPs fall within a known SmartApe bulletproof hosting range (AS56694). It relies on parsing email header IPs (headers.ips) and applies a beta ip_in() operator to determine if any header IP matches any of the listed IPv4/IPv6 prefixes. A match indicates that the inbound mail traversed an IP space associated with SmartApe as of 2026-08-05, suggesting potential abuse-sourced delivery (e.g., phishing, malware, or fraud). The rule is triggered on inbound mail with header-derived IPs that fall inside the enumerated CIDR blocks, including both IPv4 and IPv6 ranges. Detection methods reference header analysis and sender analysis to corroborate the origin. Attacker techniques cited include evasion and social engineering, reflecting typical use of bulletproof hosting to bypass controls. The rule’s IP set includes dozens of prefixes (e.g., 5.188.60.0/24, 31.177.108.0/22, 188.127.224.0/20, 2a06:dd00::/32, 2a0f:6fc5:3e84::/48, etc.). Severity is medium and the rule targets behaviors commonly associated with BEC/Fraud, Credential Phishing, and Malware/Ransomware campaigns by leveraging inbound mail from bulletproof hosting.