# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 28 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 205759 — https://publicmosaic.com/asn/205759
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 36.255.97.86 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9105808; rev:2;)
alert tls $HOME_NET any -> 36.255.97.86 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"055b576a9afecc5ef42ad895363f7796a867d9aa07d794565166daeb6a4eff91"; reference:url,publicmosaic.com/indicators; sid:9103945; rev:2;)
alert tcp $HOME_NET any -> 36.255.97.162 8033 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104260; rev:2;)
alert tcp $HOME_NET any -> 36.255.97.175 4445 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9105698; rev:2;)
alert tcp $HOME_NET any -> 43.228.157.252 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102153; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.16 1011 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102152; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.16 2202 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102151; rev:2;)
alert tls $HOME_NET any -> 46.151.182.17 5555 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"ea6d84a6d0d2b6fc9cbe474af26dc2f9893050937549119665a192d03f7f9158"; reference:url,publicmosaic.com/indicators; sid:9103822; rev:2;)
alert tls $HOME_NET any -> 46.151.182.30 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"3047699a8c734230d8efb9f5a216f1f63cf628464cb7dca9312982f71608acad"; reference:url,publicmosaic.com/indicators; sid:9103298; rev:2;)
alert tls $HOME_NET any -> 46.151.182.30 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"3047699a8c734230d8efb9f5a216f1f63cf628464cb7dca9312982f71608acad"; reference:url,publicmosaic.com/indicators; sid:9103297; rev:2;)
alert tls $HOME_NET any -> 46.151.182.98 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"1ffe4fb2900415c8265d1d302f89bae3ba7c2436a8c3100988c04cabe548b118"; reference:url,publicmosaic.com/indicators; sid:9101051; rev:2;)
alert tls $HOME_NET any -> 46.151.182.98 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"1ffe4fb2900415c8265d1d302f89bae3ba7c2436a8c3100988c04cabe548b118"; reference:url,publicmosaic.com/indicators; sid:9101059; rev:2;)
alert tls $HOME_NET any -> 46.151.182.182 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4e98f61b5d6a53e6870486f24d70f260bd8728381932cc1ba42d95bbf141c6c8"; reference:url,publicmosaic.com/indicators; sid:9104696; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.182 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103958; rev:2;)
alert tls $HOME_NET any -> 46.151.182.182 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7fda6f6135fbf79b8e2ce2328bf381a5ec06ad4ee39a499159e0773f9c9a7631"; reference:url,publicmosaic.com/indicators; sid:9100391; rev:2;)
alert tls $HOME_NET any -> 46.151.182.190 4443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"a9d04845d472afc560615605a8f221e64c9e8ef90bb911fa38d614bab8b3335e"; reference:url,publicmosaic.com/indicators; sid:9104026; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.205 6606 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9102150; rev:2;)
alert tls $HOME_NET any -> 46.151.182.224 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"2efaa44a207ed4b8be55569ed079e3971cc1216e60536fd8f69f18a5e9aa2c7c"; reference:url,publicmosaic.com/indicators; sid:9102076; rev:2;)
alert tls $HOME_NET any -> 64.89.160.4 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"d5df6d7153adbea5c824471bd3e4e72b94ac1df83105e8bbf1bfb0cde375c0f8"; reference:url,publicmosaic.com/indicators; sid:9100041; rev:2;)
alert tls $HOME_NET any -> 64.89.160.29 19132 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"19b7360ff7b53ea3e95bc8de2bbb42c5f56199ca2e3dbb6a9e2fe8f358b43dda"; reference:url,publicmosaic.com/indicators; sid:9104152; rev:2;)
alert tcp $HOME_NET any -> 64.89.160.44 7777 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104512; rev:2;)
alert tls $HOME_NET any -> 64.89.160.47 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"25863286a52c674f369fb372a4312871a12c01f05e4e1a99a19b3140712ec3ff"; reference:url,publicmosaic.com/indicators; sid:9101655; rev:2;)
alert tls $HOME_NET any -> 64.89.160.77 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"635024d5b905caf41c7b01411313bb7299d33b79d8f5e09077a12793f7a6b89a"; reference:url,publicmosaic.com/indicators; sid:9101054; rev:2;)
alert tls $HOME_NET any -> 64.89.160.140 7040 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"6fc341a3014bb1653d344f6fa741af308d4aeaad1ef55cbf585239ed1a57ef37"; reference:url,publicmosaic.com/indicators; sid:9101055; rev:2;)
alert tls $HOME_NET any -> 64.89.160.140 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"6fc341a3014bb1653d344f6fa741af308d4aeaad1ef55cbf585239ed1a57ef37"; reference:url,publicmosaic.com/indicators; sid:9101056; rev:2;)
alert tls $HOME_NET any -> 64.89.161.6 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"00da4000e5ab4cd9a7ed63311ed45600e5c176a06799ce8683c55879a74edbb0"; reference:url,publicmosaic.com/indicators; sid:9102072; rev:2;)
alert tcp $HOME_NET any -> 64.89.161.65 4444 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101674; rev:2;)
alert tls $HOME_NET any -> 64.89.161.171 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"b7a8bbffdcd03b9c62f0c0de10a44102d262ce72c25968f916aecdbb1deb5967"; reference:url,publicmosaic.com/indicators; sid:9106573; rev:2;)