# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 21 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 37457 — https://publicmosaic.com/asn/37457
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 105.184.31.171 41073 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103878; rev:2;)
alert tcp $HOME_NET any -> 105.184.34.115 49289 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106435; rev:2;)
alert tcp $HOME_NET any -> 105.184.42.145 36337 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104076; rev:2;)
alert tcp $HOME_NET any -> 105.184.91.101 41339 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101870; rev:2;)
alert tcp $HOME_NET any -> 105.184.105.108 53225 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105297; rev:2;)
alert tcp $HOME_NET any -> 105.184.177.144 55771 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106154; rev:2;)
alert tcp $HOME_NET any -> 105.184.180.148 36857 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106381; rev:2;)
alert tcp $HOME_NET any -> 105.184.232.230 54381 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105841; rev:2;)
alert tcp $HOME_NET any -> 105.184.248.13 58983 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105604; rev:2;)
alert tcp $HOME_NET any -> 105.186.83.56 41911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103858; rev:2;)
alert tcp $HOME_NET any -> 105.186.83.83 55579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105059; rev:2;)
alert tcp $HOME_NET any -> 105.186.112.68 48101 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103857; rev:2;)
alert tcp $HOME_NET any -> 105.186.189.253 52445 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105058; rev:2;)
alert tcp $HOME_NET any -> 105.186.220.180 42471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106709; rev:2;)
alert tcp $HOME_NET any -> 105.187.26.237 37077 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103856; rev:2;)
alert tcp $HOME_NET any -> 105.187.32.75 37955 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106708; rev:2;)
alert tcp $HOME_NET any -> 105.224.34.139 60105 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106262; rev:2;)
alert tcp $HOME_NET any -> 105.224.60.250 44945 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106554; rev:2;)
alert tcp $HOME_NET any -> 105.224.242.127 37969 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106113; rev:2;)
alert tcp $HOME_NET any -> 105.225.48.83 57349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103803; rev:2;)
alert tcp $HOME_NET any -> 105.225.86.238 41431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101895; rev:2;)