# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 41 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 139659 — https://publicmosaic.com/asn/139659
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 2
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 38.55.194.135 9980 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101016; rev:2;)
alert tcp $HOME_NET any -> 38.55.199.2 93 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106796; rev:2;)
alert tcp $HOME_NET any -> 38.55.199.242 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104181; rev:2;)
alert tcp $HOME_NET any -> 38.147.170.102 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103170; rev:2;)
alert tls $HOME_NET any -> 38.147.170.252 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"69373af9fc6110aa2c10044c9554da3f885b516e77431b057b9b78a8614f3401"; reference:url,publicmosaic.com/indicators; sid:9102009; rev:2;)
alert tls $HOME_NET any -> 38.207.177.71 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"994927dd1b28be4a7fea776ceebf1e37863266bfdff6a4a845fd616864da955e"; reference:url,publicmosaic.com/indicators; sid:9100541; rev:2;)
alert tcp $HOME_NET any -> 38.207.177.73 9966 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100154; rev:2;)
alert tcp $HOME_NET any -> 38.207.178.19 18082 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105340; rev:2;)
alert tcp $HOME_NET any -> 38.207.178.223 50001 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9101015; rev:2;)
alert tls $HOME_NET any -> 45.136.13.14 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"05518cef42fee350b42a2af90d8d5081358c149b1eea5b36203a29cee0f3f6aa"; reference:url,publicmosaic.com/indicators; sid:9100393; rev:2;)
alert tcp $HOME_NET any -> 45.136.14.91 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103079; rev:2;)
alert tcp $HOME_NET any -> 45.136.14.91 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103078; rev:2;)
alert tcp $HOME_NET any -> 45.136.14.91 8088 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103077; rev:2;)
alert tls $HOME_NET any -> 45.136.14.224 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"d2d4b7b44b63a96d20ef1fc926b6800a91007133914fc934057c2493a005d6ab"; reference:url,publicmosaic.com/indicators; sid:9105954; rev:2;)
alert tls $HOME_NET any -> 45.136.15.6 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"27530809ecf9400907f7d467fdf49d2cb162d3bd3d6cf76c3352d1589163fa3b"; reference:url,publicmosaic.com/indicators; sid:9100389; rev:2;)
alert tls $HOME_NET any -> 45.145.228.16 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a270434eba01fcaa09a9953050dff2f2b15004e27b3446e01ade61b93edb6cf4"; reference:url,publicmosaic.com/indicators; sid:9104233; rev:2;)
alert tcp $HOME_NET any -> 45.145.228.16 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102217; rev:2;)
alert tls $HOME_NET any -> 45.145.228.142 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a918e8c08ffc1fcee6d8f29ee1a7d06c738d20a8be4e7b9c30d4b3dceb29dd"; reference:url,publicmosaic.com/indicators; sid:9102005; rev:2;)
alert tcp $HOME_NET any -> 45.145.228.142 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100509; rev:2;)
alert tls $HOME_NET any -> 68.64.182.169 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"1893dfe81a08bf41740a599f14ab1b108bbcf7c0895f051fe2c5af02f7174cb9"; reference:url,publicmosaic.com/indicators; sid:9105158; rev:2;)
alert tls $HOME_NET any -> 83.229.120.73 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"bf17b0f29a8ec5d60980bf25146e0615273406481f4ab81377a7b962ca082ca6"; reference:url,publicmosaic.com/indicators; sid:9100535; rev:2;)
alert tls $HOME_NET any -> 83.229.123.201 2096 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"b5728f09465d74fb41abba4fba542d65ec7cc9f5b8580f642eb061d07d7f73ef"; reference:url,publicmosaic.com/indicators; sid:9104025; rev:2;)
alert tcp $HOME_NET any -> 83.229.123.240 23679 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105692; rev:2;)
alert tcp $HOME_NET any -> 83.229.123.240 61144 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105691; rev:2;)
alert tcp $HOME_NET any -> 83.229.123.249 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9105633; rev:2;)
alert tcp $HOME_NET any -> 83.229.123.249 8080 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106349; rev:2;)
alert tls $HOME_NET any -> 83.229.123.249 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"bdb5a0dce33a675b637a65bbba5a48c8a29d793d69f6c02c060740682f9de466"; reference:url,publicmosaic.com/indicators; sid:9106348; rev:2;)
alert tcp $HOME_NET any -> 83.229.123.249 9090 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106476; rev:2;)
alert tcp $HOME_NET any -> 83.229.126.134 8506 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104680; rev:2;)
alert tls $HOME_NET any -> 149.104.28.204 3656 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3003df3ed778b33750e7a8ba1827e4b94688615766cf7df8de271f66503e4b4f"; reference:url,publicmosaic.com/indicators; sid:9104496; rev:2;)
alert tcp $HOME_NET any -> 149.104.28.204 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100948; rev:2;)
alert tcp $HOME_NET any -> 149.104.28.204 9879 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100648; rev:2;)
alert tcp $HOME_NET any -> 149.104.28.204 61372 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106083; rev:2;)
alert tls $HOME_NET any -> 193.134.208.216 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"71cae8a0a932bb6928dcd33cdbccbf2881b0ee50cd00791a8f8a0f99449b689c"; reference:url,publicmosaic.com/indicators; sid:9105957; rev:2;)
alert tls $HOME_NET any -> 193.134.208.222 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"71cae8a0a932bb6928dcd33cdbccbf2881b0ee50cd00791a8f8a0f99449b689c"; reference:url,publicmosaic.com/indicators; sid:9105952; rev:2;)
alert tcp $HOME_NET any -> 193.134.209.166 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100930; rev:2;)
alert tcp $HOME_NET any -> 207.57.128.50 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102598; rev:2;)
alert tcp $HOME_NET any -> 207.57.128.50 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102597; rev:2;)
alert tls $HOME_NET any -> 207.57.134.202 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"8848f4cc93d21742dd71884c06aaa159bf143b186ab5e9ed1f822fdcd8f0d489"; reference:url,publicmosaic.com/indicators; sid:9100725; rev:2;)
alert tls $HOME_NET any -> 207.57.135.209 4443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9c4f713a3bb89a9e7cdd52e0d7a2f6d07a86eed6405abf8fab44be704a6da67e"; reference:url,publicmosaic.com/indicators; sid:9100793; rev:2;)
alert tls $HOME_NET any -> 207.57.135.209 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b7e354f08985ad0d4d993e8c45182e3d22167f4620bc5d5501f7cc6248ca7fc7"; reference:url,publicmosaic.com/indicators; sid:9100290; rev:2;)