# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 69 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 138995 — https://publicmosaic.com/asn/138995
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 45.192.167.143 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9105807; rev:2;)
alert tcp $HOME_NET any -> 45.192.169.254 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101144; rev:2;)
alert tcp $HOME_NET any -> 45.192.211.116 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106466; rev:2;)
alert tcp $HOME_NET any -> 45.192.211.116 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106465; rev:2;)
alert tls $HOME_NET any -> 45.192.211.116 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1adca882e4c5aad436a77549adf345a0750496407b605ec42e3f38bef6440217"; reference:url,publicmosaic.com/indicators; sid:9106071; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.11 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103074; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.11 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103073; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.15 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103072; rev:2;)
alert tcp $HOME_NET any -> 45.192.213.15 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103071; rev:2;)
alert tls $HOME_NET any -> 45.192.214.41 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"03c53006380da459c0a7108732a714f92eab9760f6eeb87f5ca0342b53a88e8c"; reference:url,publicmosaic.com/indicators; sid:9103921; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.54 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106464; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.54 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106463; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.55 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106462; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.55 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106461; rev:2;)
alert tcp $HOME_NET any -> 45.192.214.55 56003 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106460; rev:2;)
alert tls $HOME_NET any -> 45.192.219.30 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"427cef7f19c1019fa18fd9dd0879f74294da9a3d3810da55b9acb08591c75376"; reference:url,publicmosaic.com/indicators; sid:9105951; rev:2;)
alert tls $HOME_NET any -> 45.192.219.38 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"427cef7f19c1019fa18fd9dd0879f74294da9a3d3810da55b9acb08591c75376"; reference:url,publicmosaic.com/indicators; sid:9105955; rev:2;)
alert tls $HOME_NET any -> 45.192.226.12 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"03c53006380da459c0a7108732a714f92eab9760f6eeb87f5ca0342b53a88e8c"; reference:url,publicmosaic.com/indicators; sid:9103920; rev:2;)
alert tcp $HOME_NET any -> 45.192.226.20 56001 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106459; rev:2;)
alert tcp $HOME_NET any -> 45.192.226.20 56002 (msg:"HOLLOWPOINT C2 pure_rat"; reference:url,publicmosaic.com/indicators; sid:9106458; rev:2;)
alert tls $HOME_NET any -> 45.194.36.21 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"2a5b40814c306539f2b23c69ade7c4187f7ce6cb929080c64eeee3d7d3b94aa3"; reference:url,publicmosaic.com/indicators; sid:9101841; rev:2;)
alert tcp $HOME_NET any -> 45.194.37.207 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106629; rev:2;)
alert tcp $HOME_NET any -> 103.208.87.59 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104053; rev:2;)
alert tls $HOME_NET any -> 108.187.1.190 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8bdce35a2bffa6a18276f136ac068a51789368c16e5f673df8f226cd60e9f138"; reference:url,publicmosaic.com/indicators; sid:9101811; rev:2;)
alert tls $HOME_NET any -> 108.187.4.95 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"6e725550d4977c2272d45c991f1e7798a5474f16a58707b8544f0053f652f509"; reference:url,publicmosaic.com/indicators; sid:9100878; rev:2;)
alert tls $HOME_NET any -> 108.187.6.81 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"45bac7bdd83caf1583b3ed28c2d5f812284cc6cc063c9a0f72a26d7de120a6e2"; reference:url,publicmosaic.com/indicators; sid:9106805; rev:2;)
alert tls $HOME_NET any -> 108.187.6.157 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"1fbb6708e2ed2213a30c5efcf1e08ca445b9c77248c09aedd61cdcc2b9fd8a47"; reference:url,publicmosaic.com/indicators; sid:9105953; rev:2;)
alert tls $HOME_NET any -> 108.187.6.166 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"1fbb6708e2ed2213a30c5efcf1e08ca445b9c77248c09aedd61cdcc2b9fd8a47"; reference:url,publicmosaic.com/indicators; sid:9105950; rev:2;)
alert tls $HOME_NET any -> 108.187.7.167 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46bc95551968839d62a95e718d4c110d3940e6887dbb937b318d8658f9d9dfe6"; reference:url,publicmosaic.com/indicators; sid:9103917; rev:2;)
alert tls $HOME_NET any -> 108.187.37.250 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"36f0d9dda0ea06e372ee315741d1d57b974f34437ceea66cda3a8ff44a5ed114"; reference:url,publicmosaic.com/indicators; sid:9105949; rev:2;)
alert tls $HOME_NET any -> 108.187.37.252 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"36f0d9dda0ea06e372ee315741d1d57b974f34437ceea66cda3a8ff44a5ed114"; reference:url,publicmosaic.com/indicators; sid:9106806; rev:2;)
alert tls $HOME_NET any -> 108.187.43.87 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"eb92fbe1ff30fb3736725584d19cabab6a916bda11dee11c4d45ec6a415bbe78"; reference:url,publicmosaic.com/indicators; sid:9101809; rev:2;)
alert tls $HOME_NET any -> 108.187.43.157 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f959c52ab733ad98135512181b828bc490c58d9c3199f44c41c4e9b103de7ad3"; reference:url,publicmosaic.com/indicators; sid:9103916; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.25 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105664; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.25 8334 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105884; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.25 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105670; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.37 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100940; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.37 8334 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102727; rev:2;)
alert tcp $HOME_NET any -> 154.92.5.37 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100942; rev:2;)
alert tls $HOME_NET any -> 154.198.49.31 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"ea90b53532c6fdbdfe121202ea3ecfe73592e69a4391b1d853fa578b83fb77cd"; reference:url,publicmosaic.com/indicators; sid:9100176; rev:2;)
alert tls $HOME_NET any -> 192.163.168.3 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"077f2790925065d4f7897c745a1f88615cdc9041e6ca3d26add8e5722c334129"; reference:url,publicmosaic.com/indicators; sid:9106635; rev:2;)
alert tls $HOME_NET any -> 192.163.168.6 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"077f2790925065d4f7897c745a1f88615cdc9041e6ca3d26add8e5722c334129"; reference:url,publicmosaic.com/indicators; sid:9101787; rev:2;)
alert tls $HOME_NET any -> 192.163.168.132 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"357e11630d507ee98e58a03bef8f8659ce7edbf3b27f61e428b6f9e1accaeefc"; reference:url,publicmosaic.com/indicators; sid:9106352; rev:2;)
alert tls $HOME_NET any -> 192.163.168.135 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"357e11630d507ee98e58a03bef8f8659ce7edbf3b27f61e428b6f9e1accaeefc"; reference:url,publicmosaic.com/indicators; sid:9101786; rev:2;)
alert tcp $HOME_NET any -> 192.163.169.147 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9106634; rev:2;)
alert tls $HOME_NET any -> 192.229.81.71 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"28391145886ce1fc25967d138692786d75b7ed8dcd91af02182e6ac1a768a18e"; reference:url,publicmosaic.com/indicators; sid:9102030; rev:2;)
alert tcp $HOME_NET any -> 192.229.115.141 80 (msg:"HOLLOWPOINT C2 sqlrce"; reference:url,publicmosaic.com/indicators; sid:9101850; rev:2;)
alert tls $HOME_NET any -> 192.229.115.141 443 (msg:"HOLLOWPOINT C2 sqlrce"; tls.cert_fingerprint; content:"97d75f3a895dbcc17111659a018fb3f9378983ccaded4aa2d11e85b60190b33f"; reference:url,publicmosaic.com/indicators; sid:9101851; rev:2;)
alert tcp $HOME_NET any -> 192.229.115.146 80 (msg:"HOLLOWPOINT C2 sqlrce"; reference:url,publicmosaic.com/indicators; sid:9101853; rev:2;)
alert tls $HOME_NET any -> 192.229.115.146 443 (msg:"HOLLOWPOINT C2 sqlrce"; tls.cert_fingerprint; content:"97d75f3a895dbcc17111659a018fb3f9378983ccaded4aa2d11e85b60190b33f"; reference:url,publicmosaic.com/indicators; sid:9101852; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101167; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101159; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101162; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101165; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101158; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101166; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101154; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101160; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101156; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101164; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101163; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101161; rev:2;)
alert tls $HOME_NET any -> 192.229.116.19 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a36361793251110db8513386b3658390e9b5d3f46aff5215a854a228512dc581"; reference:url,publicmosaic.com/indicators; sid:9101783; rev:2;)
alert tls $HOME_NET any -> 192.229.116.34 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a36361793251110db8513386b3658390e9b5d3f46aff5215a854a228512dc581"; reference:url,publicmosaic.com/indicators; sid:9101782; rev:2;)
alert tls $HOME_NET any -> 192.238.134.187 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9101785; rev:2;)
alert tls $HOME_NET any -> 192.238.134.190 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9103913; rev:2;)
alert tcp $HOME_NET any -> 192.238.141.140 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104605; rev:2;)
alert tls $HOME_NET any -> 192.238.162.8 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d01900b7ac7ccbc9119e93501adaaa9540174034c6fb0db2ba51e00210ab7d1"; reference:url,publicmosaic.com/indicators; sid:9101781; rev:2;)
alert tls $HOME_NET any -> 192.238.162.10 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d01900b7ac7ccbc9119e93501adaaa9540174034c6fb0db2ba51e00210ab7d1"; reference:url,publicmosaic.com/indicators; sid:9101784; rev:2;)