# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 61 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 132199 — https://publicmosaic.com/asn/132199
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 112.198.128.164 47005 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106434; rev:2;)
alert tcp $HOME_NET any -> 112.198.130.112 42547 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104040; rev:2;)
alert tcp $HOME_NET any -> 112.198.193.5 40399 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104278; rev:2;)
alert tcp $HOME_NET any -> 112.198.238.18 46799 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104277; rev:2;)
alert tcp $HOME_NET any -> 112.198.238.30 44431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104945; rev:2;)
alert tcp $HOME_NET any -> 120.28.135.4 35562 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106695; rev:2;)
alert tcp $HOME_NET any -> 120.28.139.121 50861 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104273; rev:2;)
alert tcp $HOME_NET any -> 120.28.144.161 39233 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105639; rev:2;)
alert tcp $HOME_NET any -> 120.28.161.11 57965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104024; rev:2;)
alert tcp $HOME_NET any -> 120.28.161.60 57495 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106694; rev:2;)
alert tcp $HOME_NET any -> 120.28.166.185 48483 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106105; rev:2;)
alert tcp $HOME_NET any -> 120.28.189.248 42675 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101899; rev:2;)
alert tcp $HOME_NET any -> 120.28.189.248 50610 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105249; rev:2;)
alert tcp $HOME_NET any -> 120.28.193.113 47346 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105248; rev:2;)
alert tcp $HOME_NET any -> 120.28.193.113 53964 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106507; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 38048 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104137; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 41877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103771; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 51325 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105247; rev:2;)
alert tcp $HOME_NET any -> 120.28.196.250 50536 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106693; rev:2;)
alert tcp $HOME_NET any -> 120.28.197.69 36816 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105246; rev:2;)
alert tcp $HOME_NET any -> 120.28.197.69 53898 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106692; rev:2;)
alert tcp $HOME_NET any -> 120.28.199.24 36535 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101900; rev:2;)
alert tcp $HOME_NET any -> 120.28.200.110 33040 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105119; rev:2;)
alert tcp $HOME_NET any -> 120.28.201.138 54526 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106506; rev:2;)
alert tcp $HOME_NET any -> 120.28.201.138 55930 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105656; rev:2;)
alert tcp $HOME_NET any -> 120.28.212.172 40293 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105245; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.36 39145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106244; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.50 47233 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104281; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.116 56895 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106243; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.200 60458 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104272; rev:2;)
alert tcp $HOME_NET any -> 120.28.219.231 49376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106242; rev:2;)
alert tcp $HOME_NET any -> 124.6.165.86 60366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106377; rev:2;)
alert tcp $HOME_NET any -> 124.6.167.121 45202 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103657; rev:2;)
alert tcp $HOME_NET any -> 124.6.167.121 57352 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104537; rev:2;)
alert tcp $HOME_NET any -> 124.6.168.74 42130 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105240; rev:2;)
alert tcp $HOME_NET any -> 124.6.169.46 58258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104036; rev:2;)
alert tcp $HOME_NET any -> 124.6.185.132 48257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103731; rev:2;)
alert tcp $HOME_NET any -> 180.190.185.100 51007 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104530; rev:2;)
alert tcp $HOME_NET any -> 180.190.186.97 52355 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104269; rev:2;)
alert tcp $HOME_NET any -> 180.190.240.131 55186 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106496; rev:2;)
alert tcp $HOME_NET any -> 180.191.16.206 48801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103726; rev:2;)
alert tcp $HOME_NET any -> 180.191.22.170 52866 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103851; rev:2;)
alert tcp $HOME_NET any -> 180.191.32.197 49164 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104034; rev:2;)
alert tcp $HOME_NET any -> 180.191.34.236 40802 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106437; rev:2;)
alert tcp $HOME_NET any -> 180.191.34.236 57057 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101905; rev:2;)
alert tcp $HOME_NET any -> 180.191.36.99 55946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101906; rev:2;)
alert tcp $HOME_NET any -> 180.191.40.108 46389 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104133; rev:2;)
alert tcp $HOME_NET any -> 180.191.42.15 44577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103725; rev:2;)
alert tcp $HOME_NET any -> 180.191.49.27 47666 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106138; rev:2;)
alert tcp $HOME_NET any -> 222.127.48.44 47607 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104265; rev:2;)
alert tcp $HOME_NET any -> 222.127.54.84 59994 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104264; rev:2;)
alert tcp $HOME_NET any -> 222.127.63.230 37978 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104528; rev:2;)
alert tcp $HOME_NET any -> 222.127.68.115 42552 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101913; rev:2;)
alert tcp $HOME_NET any -> 222.127.73.15 41760 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106664; rev:2;)
alert tcp $HOME_NET any -> 222.127.76.16 52799 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104535; rev:2;)
alert tcp $HOME_NET any -> 222.127.77.227 56118 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105213; rev:2;)
alert tcp $HOME_NET any -> 222.127.77.227 56952 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104029; rev:2;)
alert tcp $HOME_NET any -> 222.127.154.221 58286 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105212; rev:2;)
alert tcp $HOME_NET any -> 222.127.156.105 38221 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106663; rev:2;)
alert tcp $HOME_NET any -> 222.127.243.18 35695 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106662; rev:2;)
alert tcp $HOME_NET any -> 222.127.248.61 60154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106090; rev:2;)