# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 65 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 132203 — https://publicmosaic.com/asn/132203
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 43.128.130.45 56502 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103132; rev:2;)
alert tcp $HOME_NET any -> 43.130.69.135 18083 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103131; rev:2;)
alert tls $HOME_NET any -> 43.130.69.135 20214 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c79ccd6591c5f90354bfc4000255c5f6c7f17c4889414bb6949fcc9d042f09d0"; reference:url,publicmosaic.com/indicators; sid:9103130; rev:2;)
alert tls $HOME_NET any -> 43.130.127.89 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0424b5fbf834f142be52c5d5e19d9d8a7f9b17f14df2d40f06026380f3da0e51"; reference:url,publicmosaic.com/indicators; sid:9100395; rev:2;)
alert tls $HOME_NET any -> 43.131.50.177 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"36f273f7edc494897330cdf318088c81d22375e74e6ec7151f07399fbf25bbbd"; reference:url,publicmosaic.com/indicators; sid:9100698; rev:2;)
alert tls $HOME_NET any -> 43.133.164.200 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c1eec2b1700605bea6fbaba2e7152fefbc031ebf3e572cd540db80aaad63f4d3"; reference:url,publicmosaic.com/indicators; sid:9100472; rev:2;)
alert tls $HOME_NET any -> 43.133.164.200 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5f9568d3ba8cb22b55d2b5359eb13e217cf6676f1717c8c05f951b5ba8218b0c"; reference:url,publicmosaic.com/indicators; sid:9100152; rev:2;)
alert tls $HOME_NET any -> 43.133.164.200 9090 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"82b17ac2aa869842cc9b9b3406c14229e590d571d470400cff897b8ff00fa9ab"; reference:url,publicmosaic.com/indicators; sid:9101727; rev:2;)
alert tls $HOME_NET any -> 43.133.165.151 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"41b176a60667cd95e7c47481cfb9e605dc9965f475550b6df6b6a12722e64965"; reference:url,publicmosaic.com/indicators; sid:9100728; rev:2;)
alert tls $HOME_NET any -> 43.134.38.218 4543 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"8fa6b8b4af3a62adafafe4cc1605596fdbe9d52d3458b18c63c9043af2b51e5f"; reference:url,publicmosaic.com/indicators; sid:9103339; rev:2;)
alert tls $HOME_NET any -> 43.134.42.247 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"11290ba2ec7a171b4afecda0d1095855df241063af5d51e246df177911f37e21"; reference:url,publicmosaic.com/indicators; sid:9100581; rev:2;)
alert tcp $HOME_NET any -> 43.134.100.72 4444 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101012; rev:2;)
alert tls $HOME_NET any -> 43.134.169.103 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"fef947905e4d8816008fb3095c18f245f6b7cd466d7720667e20c67ae29b66fc"; reference:url,publicmosaic.com/indicators; sid:9104200; rev:2;)
alert tls $HOME_NET any -> 43.134.169.103 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b05320dbc33317a8e0c44b2f9c133a906a42b42202175e4973eabfc50b48d682"; reference:url,publicmosaic.com/indicators; sid:9100437; rev:2;)
alert tcp $HOME_NET any -> 43.134.169.162 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103129; rev:2;)
alert tcp $HOME_NET any -> 43.134.169.162 34675 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103128; rev:2;)
alert tcp $HOME_NET any -> 43.134.169.162 35675 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103127; rev:2;)
alert tls $HOME_NET any -> 43.135.26.173 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"9f904b1aef85ae53cf55bcfff4e1b8b20e2708156e075d1922b2e5528372c9f9"; reference:url,publicmosaic.com/indicators; sid:9101558; rev:2;)
alert tcp $HOME_NET any -> 43.135.26.173 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106467; rev:2;)
alert tls $HOME_NET any -> 43.135.34.69 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"1befcd3a15cbd1524d43e494bb416033da50f9e8ada46ec406c30cbcd2baf001"; reference:url,publicmosaic.com/indicators; sid:9100676; rev:2;)
alert tls $HOME_NET any -> 43.135.34.69 43911 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"57ef4e42062b8b2f6b7e6d986a2ec73752d91c2747a4a5c4243679bd4ad1d4dd"; reference:url,publicmosaic.com/indicators; sid:9102202; rev:2;)
alert tls $HOME_NET any -> 43.153.171.132 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102243; rev:2;)
alert tcp $HOME_NET any -> 43.154.86.87 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103109; rev:2;)
alert tcp $HOME_NET any -> 43.154.134.124 9999 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103108; rev:2;)
alert tcp $HOME_NET any -> 43.155.9.112 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104179; rev:2;)
alert tls $HOME_NET any -> 43.155.9.112 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9103880; rev:2;)
alert tls $HOME_NET any -> 43.155.168.253 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"9219cb59d585eb917615ea75d189f48895ce2fa98764f29c6633b3350a68c3bb"; reference:url,publicmosaic.com/indicators; sid:9100149; rev:2;)
alert tcp $HOME_NET any -> 43.155.168.253 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101202; rev:2;)
alert tls $HOME_NET any -> 43.155.169.245 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"c099f52af0291822650ff4444a77c5913e8394a56f992456a339095dbf0d6205"; reference:url,publicmosaic.com/indicators; sid:9100011; rev:2;)
alert tls $HOME_NET any -> 43.155.215.231 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ba62914971a0a901cce8a75fbea4c80007e388910a2dfd3e6a76bb90be7ccbdf"; reference:url,publicmosaic.com/indicators; sid:9103976; rev:2;)
alert tls $HOME_NET any -> 43.155.215.231 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f14c884caa1d77baf17a6bfda05b1d1dd2867dbb9058714f13bd19c0d71d6b36"; reference:url,publicmosaic.com/indicators; sid:9103713; rev:2;)
alert tls $HOME_NET any -> 43.156.61.27 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"8b7da3f368575429d068ed8665505308239a25eac788cd0d291c2134cbffd1c3"; reference:url,publicmosaic.com/indicators; sid:9101510; rev:2;)
alert tcp $HOME_NET any -> 43.156.82.119 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103107; rev:2;)
alert tcp $HOME_NET any -> 43.156.82.119 32211 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9103106; rev:2;)
alert tls $HOME_NET any -> 43.156.107.94 8887 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"184b21dedc7e9a3cf98a26f0cf47fece9a0067ac9397238e6e0a4e0cc99bb52f"; reference:url,publicmosaic.com/indicators; sid:9100052; rev:2;)
alert tcp $HOME_NET any -> 43.156.179.8 4433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103105; rev:2;)
alert tls $HOME_NET any -> 43.156.184.213 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c7e956c59e1c8c2a944b957f2a3eba8ac66dfa53cf4689350685bc1a3e68ebdd"; reference:url,publicmosaic.com/indicators; sid:9101583; rev:2;)
alert tls $HOME_NET any -> 43.157.204.73 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9c9f75b9e849e602d355ac9743b24c9acd5f58c5c5f22e152859df2809b70567"; reference:url,publicmosaic.com/indicators; sid:9104464; rev:2;)
alert tls $HOME_NET any -> 43.157.204.73 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"48c700cb03fc4616c6e5d7632993939b63a5f79be5d5a2405af23fee41f07e6d"; reference:url,publicmosaic.com/indicators; sid:9103712; rev:2;)
alert tls $HOME_NET any -> 43.157.204.73 51837 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"48c700cb03fc4616c6e5d7632993939b63a5f79be5d5a2405af23fee41f07e6d"; reference:url,publicmosaic.com/indicators; sid:9103711; rev:2;)
alert tcp $HOME_NET any -> 43.160.218.110 8081 (msg:"HOLLOWPOINT C2 btmob"; reference:url,publicmosaic.com/indicators; sid:9101546; rev:2;)
alert tls $HOME_NET any -> 43.160.235.200 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6db16b0b17fdd9dee47a674678149718bbb85b217f7c00cbb7e79ee077205255"; reference:url,publicmosaic.com/indicators; sid:9100807; rev:2;)
alert tls $HOME_NET any -> 43.161.234.96 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"c4b748c50b2267aa93b38d4b882b1496d3c06b193effc2b3207922fcad2fb82f"; reference:url,publicmosaic.com/indicators; sid:9102007; rev:2;)
alert tcp $HOME_NET any -> 43.163.88.35 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100020; rev:2;)
alert tls $HOME_NET any -> 43.163.111.133 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"16a758b6bd68bebb821805bfa9b03eff5b78416867709b5ba0de1943551540e9"; reference:url,publicmosaic.com/indicators; sid:9100618; rev:2;)
alert tls $HOME_NET any -> 43.163.208.239 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4a690038e2efdf6e428933d91217de9981bdf1c6ef2fd8b1e057b64900646abf"; reference:url,publicmosaic.com/indicators; sid:9103710; rev:2;)
alert tls $HOME_NET any -> 43.164.191.203 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102242; rev:2;)
alert tcp $HOME_NET any -> 43.165.168.164 4455 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103104; rev:2;)
alert tcp $HOME_NET any -> 43.167.177.224 7778 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103436; rev:2;)
alert tcp $HOME_NET any -> 43.173.70.252 4455 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103103; rev:2;)
alert tcp $HOME_NET any -> 49.51.230.17 9001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102992; rev:2;)
alert tcp $HOME_NET any -> 49.51.230.17 9898 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102991; rev:2;)
alert tls $HOME_NET any -> 49.51.230.17 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"02fd77af71d8670199c4295286416c3aa3f06100430725c9e3feab0cec10dfe3"; reference:url,publicmosaic.com/indicators; sid:9105194; rev:2;)
alert tcp $HOME_NET any -> 49.51.230.17 53001 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9102990; rev:2;)
alert tcp $HOME_NET any -> 101.32.34.248 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106336; rev:2;)
alert tcp $HOME_NET any -> 101.32.241.197 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102573; rev:2;)
alert tcp $HOME_NET any -> 101.33.45.136 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102572; rev:2;)
alert tls $HOME_NET any -> 119.28.212.86 44321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b9438277f002116ec8278c0d5f5bd2f8fec5fe3833a8f768dfe1e0dba996c05d"; reference:url,publicmosaic.com/indicators; sid:9102183; rev:2;)
alert tcp $HOME_NET any -> 124.156.169.80 8000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103819; rev:2;)
alert tls $HOME_NET any -> 129.226.150.240 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e1076df45f07c971a53dc0df31c5bfc31597eacc9b0ffeb2f5afecd301055a6d"; reference:url,publicmosaic.com/indicators; sid:9105997; rev:2;)
alert tls $HOME_NET any -> 129.226.195.254 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"164902129fafd0fafc03a2a8a19d01c592a5651c06bde7e9e3295f22d065f2b2"; reference:url,publicmosaic.com/indicators; sid:9100348; rev:2;)
alert tcp $HOME_NET any -> 150.109.94.129 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100947; rev:2;)
alert tcp $HOME_NET any -> 150.109.94.129 6666 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101180; rev:2;)
alert tls $HOME_NET any -> 150.109.154.3 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"cc4e38e8bfc5340907b5019d6bb4c9984aead14b173a5c14bd2c6a7ca417fbf2"; reference:url,publicmosaic.com/indicators; sid:9105995; rev:2;)
alert tcp $HOME_NET any -> 170.106.188.119 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103482; rev:2;)