This rule flags inbound emails by inspecting the Received header chain for IPs that transit media hosting IP space associated with Media Land LLC or ML Cloud LLC, which are sanctioned by OFAC as of 2025-11-19 for providing bulletproof hosting to ransomware operations and related attacks. It leverages a beta IP-matching feature (ip_in) to detect both IPv4 and IPv6 prefixes tied to the ASNs (AS206728, AS215376). Specifically, it matches IPv4 blocks 45.141.85.0/24, 91.220.163.0/24, 176.98.187.0/24 and IPv6 blocks 2a0b:7ec0:1320::/48, 2a0b:7ec0:7701::/48. When a mail path traverses these ranges, the rule triggers with high severity. The detection relies on header analysis and sender analysis of inbound mail and is intended to aid in blocking or alerting on traffic that transits sanctioned bulletproof hosting infrastructure used by actors such as LockBit, BlackSuit, and Play ransomware groups, and for related DDoS activities. The rule notes its beta feature status and potential changes over time.