# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 45 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 138915 — https://publicmosaic.com/asn/138915
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 38.54.1.21 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103188; rev:2;)
alert tls $HOME_NET any -> 38.54.8.74 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"a7d3a614a14c509a3d4b7eb7bc90ed02cf6ea3f312d66ff9edb48f134198057a"; reference:url,publicmosaic.com/indicators; sid:9100473; rev:2;)
alert tcp $HOME_NET any -> 38.54.13.44 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103187; rev:2;)
alert tcp $HOME_NET any -> 38.54.14.80 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104097; rev:2;)
alert tcp $HOME_NET any -> 38.54.40.184 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103186; rev:2;)
alert tcp $HOME_NET any -> 38.54.50.36 8080 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9106649; rev:2;)
alert tcp $HOME_NET any -> 38.54.63.84 9988 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103185; rev:2;)
alert tcp $HOME_NET any -> 38.54.63.135 53 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100677; rev:2;)
alert tls $HOME_NET any -> 38.54.63.135 80 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"43cec44e4918df6b585bb6c3d9ad72f38e6d8861e71f8fe7a873706b27060783"; reference:url,publicmosaic.com/indicators; sid:9100619; rev:2;)
alert tls $HOME_NET any -> 38.54.88.188 65533 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ecb2dd32dbba0c2e61b7e024398bc486d53d56ff09be281e561c842aec4e6985"; reference:url,publicmosaic.com/indicators; sid:9100425; rev:2;)
alert tls $HOME_NET any -> 38.54.94.117 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"0093bb4742c23ac2a8c170cc35508acbd8c876a60c174d2adb76604916f4af4c"; reference:url,publicmosaic.com/indicators; sid:9104154; rev:2;)
alert tls $HOME_NET any -> 38.54.94.117 4783 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"0093bb4742c23ac2a8c170cc35508acbd8c876a60c174d2adb76604916f4af4c"; reference:url,publicmosaic.com/indicators; sid:9105540; rev:2;)
alert tcp $HOME_NET any -> 38.54.95.51 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103184; rev:2;)
alert tcp $HOME_NET any -> 38.54.95.51 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103183; rev:2;)
alert tcp $HOME_NET any -> 38.54.95.136 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103182; rev:2;)
alert tls $HOME_NET any -> 38.54.97.169 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"567080c8ede967bcb042a54d65179cd376fb651b2d98c95079d892fa53434ffb"; reference:url,publicmosaic.com/indicators; sid:9106565; rev:2;)
alert tls $HOME_NET any -> 38.60.203.203 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3920e7a1e3c0c271c425e519a0e40c35ba218c4ae885c9d2ccaf98450e8f467a"; reference:url,publicmosaic.com/indicators; sid:9101457; rev:2;)
alert tls $HOME_NET any -> 38.60.212.240 80 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2396af38b5604bb98e6ca10873068f940582149d30b2dc47c3eeab85ecbd43a4"; reference:url,publicmosaic.com/indicators; sid:9105801; rev:2;)
alert tls $HOME_NET any -> 38.60.220.112 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f6e82441c228e618f3f6da47b7beb6b0dec17838b14d41b358e5f1b0bffcda71"; reference:url,publicmosaic.com/indicators; sid:9101703; rev:2;)
alert tls $HOME_NET any -> 38.60.220.112 58741 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7dde61824bcee402ff5b7dd682a2a615577b00e1abb49fb1a443576580b57adb"; reference:url,publicmosaic.com/indicators; sid:9103714; rev:2;)
alert tcp $HOME_NET any -> 38.60.241.251 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103178; rev:2;)
alert tcp $HOME_NET any -> 38.60.241.251 1443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103177; rev:2;)
alert tcp $HOME_NET any -> 38.60.241.251 4443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103176; rev:2;)
alert tls $HOME_NET any -> 38.60.241.251 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"451a3ae1a19400db51a4eb8cbbea15682ec351f0d165549ae6332843e600382a"; reference:url,publicmosaic.com/indicators; sid:9100740; rev:2;)
alert tcp $HOME_NET any -> 38.60.242.230 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103175; rev:2;)
alert tcp $HOME_NET any -> 38.60.242.230 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103174; rev:2;)
alert tcp $HOME_NET any -> 38.60.245.181 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105661; rev:2;)
alert tcp $HOME_NET any -> 38.60.245.181 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105665; rev:2;)
alert tls $HOME_NET any -> 38.60.250.235 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"5c2fc5ef5c9aef4902d732d4f5ee9568eb4cced4906bd099790927ea0a37a0ce"; reference:url,publicmosaic.com/indicators; sid:9101847; rev:2;)
alert tcp $HOME_NET any -> 38.60.252.124 80 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101147; rev:2;)
alert tcp $HOME_NET any -> 38.60.252.124 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101146; rev:2;)
alert tls $HOME_NET any -> 149.104.71.157 8000 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3d09feccdd6f558cc63beafe4fcdd515d56f1f221563f43a40c3a12c5dfa2198"; reference:url,publicmosaic.com/indicators; sid:9100644; rev:2;)
alert tls $HOME_NET any -> 149.104.71.157 9443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0a8a16097019d0b3ba75508dab91ffcbc4e27e2a3f04c50a84025a738b6443e9"; reference:url,publicmosaic.com/indicators; sid:9100647; rev:2;)
alert tcp $HOME_NET any -> 149.104.87.217 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101602; rev:2;)
alert tls $HOME_NET any -> 149.104.90.17 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3fe06d4c66c67bc09050e370aa14f352e8be7198ea6a0417fbe341e5b2b8ee67"; reference:url,publicmosaic.com/indicators; sid:9101717; rev:2;)
alert tls $HOME_NET any -> 149.104.90.17 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e546368a0963f931bc1d71de435567e5bb348564040bb23b2e3cc8ff46e600ea"; reference:url,publicmosaic.com/indicators; sid:9101639; rev:2;)
alert tcp $HOME_NET any -> 154.93.103.232 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104610; rev:2;)
alert tls $HOME_NET any -> 154.93.103.232 60317 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3c9b05bd6d3274c56e4a099205f8d8eae7904a4512c6970c316564d457d68091"; reference:url,publicmosaic.com/indicators; sid:9103682; rev:2;)
alert tls $HOME_NET any -> 154.205.145.109 2096 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"dbe90fd89cbee0bf150ba06ce226ddcf817caca14991bd188484da3368311abe"; reference:url,publicmosaic.com/indicators; sid:9105143; rev:2;)
alert tcp $HOME_NET any -> 154.206.98.85 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103500; rev:2;)
alert tcp $HOME_NET any -> 154.206.99.60 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103499; rev:2;)
alert tcp $HOME_NET any -> 154.223.16.184 4388 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103493; rev:2;)
alert tcp $HOME_NET any -> 156.244.9.19 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102720; rev:2;)
alert tcp $HOME_NET any -> 156.244.9.19 9094 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102719; rev:2;)
alert tcp $HOME_NET any -> 194.26.73.23 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102646; rev:2;)