# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 37 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 141679 — https://publicmosaic.com/asn/141679
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 111.228.2.9 50002 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102485; rev:2;)
alert tcp $HOME_NET any -> 111.228.4.54 4455 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103453; rev:2;)
alert tls $HOME_NET any -> 111.228.4.54 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"27e65a5fa9510a489a79890a1ebdc5551f6a0ebf106c99b8d09e1a80bbc94de7"; reference:url,publicmosaic.com/indicators; sid:9100022; rev:2;)
alert tls $HOME_NET any -> 111.228.5.127 5435 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9106658; rev:2;)
alert tls $HOME_NET any -> 111.228.13.59 18443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"336b2236df745863a58f1412eab2c19547c38385dabc59d02872bae21409936c"; reference:url,publicmosaic.com/indicators; sid:9103338; rev:2;)
alert tcp $HOME_NET any -> 111.228.26.26 7777 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102484; rev:2;)
alert tcp $HOME_NET any -> 111.228.27.89 5663 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106172; rev:2;)
alert tcp $HOME_NET any -> 111.228.27.89 5788 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106171; rev:2;)
alert tcp $HOME_NET any -> 111.228.35.42 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102483; rev:2;)
alert tcp $HOME_NET any -> 111.228.49.20 80 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106421; rev:2;)
alert tls $HOME_NET any -> 111.228.55.96 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100214; rev:2;)
alert tls $HOME_NET any -> 111.228.55.96 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a06a233bd30f693de25ef12cc19e8b2c92d3eb97dd969a2578df084c376478"; reference:url,publicmosaic.com/indicators; sid:9100236; rev:2;)
alert tls $HOME_NET any -> 117.72.32.75 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102229; rev:2;)
alert tls $HOME_NET any -> 117.72.38.14 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1e45dd529d8d8cb8bf101a197b52128d145b2878d9e97952dbac7243922818b3"; reference:url,publicmosaic.com/indicators; sid:9102291; rev:2;)
alert tcp $HOME_NET any -> 117.72.38.14 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100501; rev:2;)
alert tls $HOME_NET any -> 117.72.72.254 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"da248368bf997b800cefde72afb20bba6cd4afe98c6e754ca7c03573123e6bca"; reference:url,publicmosaic.com/indicators; sid:9104060; rev:2;)
alert tcp $HOME_NET any -> 117.72.72.254 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100495; rev:2;)
alert tcp $HOME_NET any -> 117.72.99.21 9999 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104576; rev:2;)
alert tcp $HOME_NET any -> 117.72.100.236 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102867; rev:2;)
alert tcp $HOME_NET any -> 117.72.103.9 62521 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104575; rev:2;)
alert tcp $HOME_NET any -> 117.72.119.63 7088 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102215; rev:2;)
alert tcp $HOME_NET any -> 117.72.125.206 8888 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104228; rev:2;)
alert tcp $HOME_NET any -> 117.72.125.206 11111 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104574; rev:2;)
alert tcp $HOME_NET any -> 117.72.148.131 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104676; rev:2;)
alert tcp $HOME_NET any -> 117.72.159.96 9998 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100276; rev:2;)
alert tls $HOME_NET any -> 117.72.181.104 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100417; rev:2;)
alert tls $HOME_NET any -> 117.72.182.5 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9100186; rev:2;)
alert tcp $HOME_NET any -> 117.72.200.129 18084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9104573; rev:2;)
alert tls $HOME_NET any -> 117.72.202.93 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"9d0770e174b8c378c22a44ced46e248700d25dde4441f31a05e8c4fb4412f501"; reference:url,publicmosaic.com/indicators; sid:9102290; rev:2;)
alert tcp $HOME_NET any -> 117.72.202.93 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9104509; rev:2;)
alert tls $HOME_NET any -> 117.72.209.125 3333 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"e3e81c5210e77732fed9beed3f694fa309b40a76d80d3acc5bc9f5d3a4787b1b"; reference:url,publicmosaic.com/indicators; sid:9102289; rev:2;)
alert tcp $HOME_NET any -> 117.72.242.9 9999 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100275; rev:2;)
alert tls $HOME_NET any -> 117.72.242.9 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a7660630f6c0bf27970e2930fdfe416358004a3e5c04ecad4e5184e48389b561"; reference:url,publicmosaic.com/indicators; sid:9100230; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 8766 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9106826; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 9003 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9100552; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9100546; rev:2;)
alert tls $HOME_NET any -> 220.154.3.197 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"06b22b08b071b67b81574190c79463b637571fd197f0f1ab67ca56f7460f81c7"; reference:url,publicmosaic.com/indicators; sid:9100548; rev:2;)