# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 21 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 140869 — https://publicmosaic.com/asn/140869
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 38.60.125.131 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103180; rev:2;)
alert tcp $HOME_NET any -> 38.60.125.131 888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103179; rev:2;)
alert tcp $HOME_NET any -> 50.114.184.157 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100971; rev:2;)
alert tcp $HOME_NET any -> 50.114.184.157 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100973; rev:2;)
alert tcp $HOME_NET any -> 50.114.184.157 9091 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102975; rev:2;)
alert tcp $HOME_NET any -> 144.225.137.26 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105328; rev:2;)
alert tcp $HOME_NET any -> 154.81.34.82 13389 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102332; rev:2;)
alert tcp $HOME_NET any -> 170.62.130.234 443 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100641; rev:2;)
alert tcp $HOME_NET any -> 204.194.51.97 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102632; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102631; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102630; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102629; rev:2;)
alert tcp $HOME_NET any -> 204.194.53.9 9443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101652; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.54 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102628; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.54 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102627; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.54 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102626; rev:2;)
alert tls $HOME_NET any -> 204.194.54.61 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9958f8992a757cd5e7cdc369e5232841d847bd2d4985afb344386a3a50fc9c4e"; reference:url,publicmosaic.com/indicators; sid:9100289; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.209 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102625; rev:2;)
alert tcp $HOME_NET any -> 204.194.54.240 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102624; rev:2;)
alert tcp $HOME_NET any -> 205.186.112.15 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102623; rev:2;)
alert tcp $HOME_NET any -> 205.186.112.15 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102622; rev:2;)