# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 14 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 154177 — https://publicmosaic.com/asn/154177
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 130.94.16.122 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105663; rev:2;)
alert tcp $HOME_NET any -> 130.94.16.122 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105630; rev:2;)
alert tcp $HOME_NET any -> 130.94.17.70 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103318; rev:2;)
alert tcp $HOME_NET any -> 130.94.17.70 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103317; rev:2;)
alert tcp $HOME_NET any -> 130.94.30.168 53 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102398; rev:2;)
alert tcp $HOME_NET any -> 130.94.30.168 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102397; rev:2;)
alert tcp $HOME_NET any -> 130.94.33.140 4433 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102396; rev:2;)
alert tcp $HOME_NET any -> 130.94.33.140 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104190; rev:2;)
alert tls $HOME_NET any -> 130.94.41.151 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"23ac47cd113eb29198e5b596e43a83be89a3f1d83faed3213c1aee26bacd788c"; reference:url,publicmosaic.com/indicators; sid:9103687; rev:2;)
alert tcp $HOME_NET any -> 130.94.66.82 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104459; rev:2;)
alert tcp $HOME_NET any -> 130.94.92.169 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102395; rev:2;)
alert tcp $HOME_NET any -> 130.94.92.169 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102394; rev:2;)
alert tls $HOME_NET any -> 130.94.92.169 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2f0ae0c48fd2fe50a237c5c09cb18b85cbc5e7f29b05a8230218da64fbe87432"; reference:url,publicmosaic.com/indicators; sid:9100346; rev:2;)
alert tls $HOME_NET any -> 130.94.105.104 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2048037dcd4cc4209cc0ab818fd94ffed56c7373e64db4c02b6c1bd2a3b7ff44"; reference:url,publicmosaic.com/indicators; sid:9106209; rev:2;)