# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 26 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 399486 — https://publicmosaic.com/asn/399486
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 31.57.38.7 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"6c2f3547c0285f4a25eb3fa79f7479dd89a6e6cfb27f7aa5f12447979fa79fed"; reference:url,publicmosaic.com/indicators; sid:9101321; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105543; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105542; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105541; rev:2;)
alert tls $HOME_NET any -> 31.57.219.139 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"8f9157c3c543ea5a0dcec829f606c5fc957c0055cabef20eacc5824ea69aea6b"; reference:url,publicmosaic.com/indicators; sid:9101284; rev:2;)
alert tcp $HOME_NET any -> 45.88.91.156 80 (msg:"HOLLOWPOINT C2 unam"; reference:url,publicmosaic.com/indicators; sid:9104460; rev:2;)
alert tls $HOME_NET any -> 79.110.49.227 30120 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a6aaa3064f7e438a1bceecce8c8519e61fb4492fba03016673a00313f1d4d28d"; reference:url,publicmosaic.com/indicators; sid:9103821; rev:2;)
alert tls $HOME_NET any -> 80.76.49.47 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"b208d25572861170e0bf53a630eec6152752077a44e7b3f9dcba1d053407db70"; reference:url,publicmosaic.com/indicators; sid:9101058; rev:2;)
alert tls $HOME_NET any -> 80.76.49.47 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"b208d25572861170e0bf53a630eec6152752077a44e7b3f9dcba1d053407db70"; reference:url,publicmosaic.com/indicators; sid:9101057; rev:2;)
alert tls $HOME_NET any -> 80.76.49.78 8080 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"feff7a5bfeb6036d428602cb82555dfe6acbc28d35d20429f846020d6c5ac32e"; reference:url,publicmosaic.com/indicators; sid:9100898; rev:2;)
alert tls $HOME_NET any -> 151.241.154.217 6767 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"78944886388d534c02de69cfe214ab325414e9c7b71527723e4652b8631f13ba"; reference:url,publicmosaic.com/indicators; sid:9100897; rev:2;)
alert tls $HOME_NET any -> 151.242.63.30 8080 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"6b88cfcd6a64409db6389bea2f84a249d9e2d23d634f1d36ddec36472a01ba85"; reference:url,publicmosaic.com/indicators; sid:9101282; rev:2;)
alert tcp $HOME_NET any -> 151.245.121.11 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102356; rev:2;)
alert tls $HOME_NET any -> 168.222.97.92 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"31181115b28e0ecf1ca51a78830214e764458c95c9f0bf6f21141b9f45e5d474"; reference:url,publicmosaic.com/indicators; sid:9101332; rev:2;)
alert tls $HOME_NET any -> 179.61.227.241 300 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"cb9f9278cb08283dae7a50015a543cd7d808dc0103088bd710b57d63ecb0ccb0"; reference:url,publicmosaic.com/indicators; sid:9103389; rev:2;)
alert tls $HOME_NET any -> 194.59.30.4 80 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106571; rev:2;)
alert tls $HOME_NET any -> 194.59.30.4 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106570; rev:2;)
alert tls $HOME_NET any -> 194.59.30.4 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106569; rev:2;)
alert tls $HOME_NET any -> 194.59.30.58 80 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9104100; rev:2;)
alert tls $HOME_NET any -> 194.59.30.58 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9102027; rev:2;)
alert tls $HOME_NET any -> 194.59.30.58 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106087; rev:2;)
alert tls $HOME_NET any -> 194.59.30.96 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"be51d86b1d7d7c07ad5256408dd548049a8de5e776678856588c7846d690a051"; reference:url,publicmosaic.com/indicators; sid:9101328; rev:2;)
alert tls $HOME_NET any -> 194.59.30.96 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"be51d86b1d7d7c07ad5256408dd548049a8de5e776678856588c7846d690a051"; reference:url,publicmosaic.com/indicators; sid:9101327; rev:2;)
alert tls $HOME_NET any -> 194.59.31.108 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"10c613ff05a07b01b6da7e21a96584418ddebfcc3e2cf7ead65a395f089c4910"; reference:url,publicmosaic.com/indicators; sid:9104516; rev:2;)
alert tls $HOME_NET any -> 194.59.31.108 8727 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"26bcf325556d637e1fb96b23f5d214469bec5b88276989fef1bebb3378d0f1f2"; reference:url,publicmosaic.com/indicators; sid:9100078; rev:2;)
alert tcp $HOME_NET any -> 194.59.31.172 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104109; rev:2;)