# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 101 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 4134 — https://publicmosaic.com/asn/4134
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 7
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 1.69.201.81 9003 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"eba6c9da4ec17017ce1738ff02941abae45a3d09a37491570ee6ca64afba66f1"; reference:url,publicmosaic.com/indicators; sid:9104247; rev:2;)
alert tls $HOME_NET any -> 1.69.201.249 9003 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"eba6c9da4ec17017ce1738ff02941abae45a3d09a37491570ee6ca64afba66f1"; reference:url,publicmosaic.com/indicators; sid:9101195; rev:2;)
alert tcp $HOME_NET any -> 14.29.160.181 8888 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9100286; rev:2;)
alert tls $HOME_NET any -> 14.29.160.181 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2c42be2a42c6c3edbf3ce7c7ef6b5a8f0c6227f3a11ec653147e82226c59ab35"; reference:url,publicmosaic.com/indicators; sid:9100245; rev:2;)
alert tls $HOME_NET any -> 14.116.159.128 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102246; rev:2;)
alert tcp $HOME_NET any -> 14.157.16.203 56002 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105285; rev:2;)
alert tcp $HOME_NET any -> 27.152.10.10 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103411; rev:2;)
alert tcp $HOME_NET any -> 27.153.152.10 40052 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103746; rev:2;)
alert tcp $HOME_NET any -> 42.243.252.236 59708 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106532; rev:2;)
alert tcp $HOME_NET any -> 60.160.2.40 34828 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105427; rev:2;)
alert tcp $HOME_NET any -> 60.184.107.9 37858 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105606; rev:2;)
alert tcp $HOME_NET any -> 60.184.138.242 45870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105281; rev:2;)
alert tcp $HOME_NET any -> 61.144.101.122 55558 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105042; rev:2;)
alert tcp $HOME_NET any -> 106.40.242.20 46263 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104917; rev:2;)
alert tcp $HOME_NET any -> 106.57.6.80 53331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101896; rev:2;)
alert tcp $HOME_NET any -> 106.57.7.26 53331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104534; rev:2;)
alert tcp $HOME_NET any -> 110.186.228.150 48917 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101897; rev:2;)
alert tcp $HOME_NET any -> 110.186.231.170 38543 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105265; rev:2;)
alert tcp $HOME_NET any -> 112.113.68.159 41597 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104041; rev:2;)
alert tcp $HOME_NET any -> 113.71.158.175 47074 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106761; rev:2;)
alert tcp $HOME_NET any -> 113.221.24.213 45414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103774; rev:2;)
alert tcp $HOME_NET any -> 113.221.25.216 37532 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105263; rev:2;)
alert tcp $HOME_NET any -> 113.221.38.108 40790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106285; rev:2;)
alert tcp $HOME_NET any -> 113.221.44.37 55307 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106259; rev:2;)
alert tcp $HOME_NET any -> 113.221.45.157 55307 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106704; rev:2;)
alert tcp $HOME_NET any -> 113.221.46.118 58353 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104139; rev:2;)
alert tcp $HOME_NET any -> 113.221.46.119 40057 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104138; rev:2;)
alert tcp $HOME_NET any -> 113.221.76.194 54955 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103736; rev:2;)
alert tcp $HOME_NET any -> 114.231.138.67 44129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105010; rev:2;)
alert tcp $HOME_NET any -> 114.232.1.222 8888 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105332; rev:2;)
alert tcp $HOME_NET any -> 114.239.63.214 39292 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106703; rev:2;)
alert tcp $HOME_NET any -> 115.192.97.236 47571 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104990; rev:2;)
alert tcp $HOME_NET any -> 115.193.205.187 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104533; rev:2;)
alert tcp $HOME_NET any -> 115.194.8.14 57404 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106514; rev:2;)
alert tcp $HOME_NET any -> 115.205.150.31 37201 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106513; rev:2;)
alert tcp $HOME_NET any -> 115.230.76.101 37221 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106151; rev:2;)
alert tcp $HOME_NET any -> 116.248.83.141 56727 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106511; rev:2;)
alert tcp $HOME_NET any -> 119.127.7.102 56002 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106148; rev:2;)
alert tcp $HOME_NET any -> 121.61.49.44 46204 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104136; rev:2;)
alert tcp $HOME_NET any -> 121.229.36.89 30625 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102428; rev:2;)
alert tcp $HOME_NET any -> 121.231.116.192 38256 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106691; rev:2;)
alert tcp $HOME_NET any -> 122.233.29.62 38332 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104038; rev:2;)
alert tcp $HOME_NET any -> 122.241.130.212 45870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104037; rev:2;)
alert tcp $HOME_NET any -> 123.161.90.221 49111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101901; rev:2;)
alert tcp $HOME_NET any -> 123.172.56.34 44140 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103735; rev:2;)
alert tcp $HOME_NET any -> 123.173.73.226 41793 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103734; rev:2;)
alert tcp $HOME_NET any -> 123.245.97.124 58336 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104532; rev:2;)
alert tcp $HOME_NET any -> 123.245.99.52 39875 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103770; rev:2;)
alert tcp $HOME_NET any -> 124.234.131.24 53745 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106376; rev:2;)
alert tcp $HOME_NET any -> 124.234.219.141 44247 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106684; rev:2;)
alert tcp $HOME_NET any -> 124.235.106.150 39827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103730; rev:2;)
alert tcp $HOME_NET any -> 124.235.130.21 59252 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103852; rev:2;)
alert tcp $HOME_NET any -> 125.65.146.164 50215 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101903; rev:2;)
alert tcp $HOME_NET any -> 125.78.40.165 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104270; rev:2;)
alert tls $HOME_NET any -> 125.86.22.29 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5edc16157c7b887458b353f4da358633f3e4399c6c112f2656e6af03f5b974f1"; reference:url,publicmosaic.com/indicators; sid:9100183; rev:2;)
alert tls $HOME_NET any -> 125.86.26.79 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5edc16157c7b887458b353f4da358633f3e4399c6c112f2656e6af03f5b974f1"; reference:url,publicmosaic.com/indicators; sid:9100109; rev:2;)
alert tcp $HOME_NET any -> 125.106.114.59 42629 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106375; rev:2;)
alert tcp $HOME_NET any -> 125.119.75.223 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106374; rev:2;)
alert tcp $HOME_NET any -> 125.126.115.194 35284 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106753; rev:2;)
alert tcp $HOME_NET any -> 144.7.106.78 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102840; rev:2;)
alert tcp $HOME_NET any -> 175.0.60.188 40182 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103729; rev:2;)
alert tcp $HOME_NET any -> 175.9.132.63 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106497; rev:2;)
alert tcp $HOME_NET any -> 175.9.165.183 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105234; rev:2;)
alert tcp $HOME_NET any -> 175.9.166.233 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104033; rev:2;)
alert tls $HOME_NET any -> 175.30.113.69 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"d5865704881747610814ecd154470245ecae90158e73b7946b75b6de01fb15b9"; reference:url,publicmosaic.com/indicators; sid:9102253; rev:2;)
alert tcp $HOME_NET any -> 175.30.114.108 44656 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104871; rev:2;)
alert tcp $HOME_NET any -> 175.31.168.229 50764 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106682; rev:2;)
alert tls $HOME_NET any -> 180.101.25.48 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102223; rev:2;)
alert tcp $HOME_NET any -> 180.104.55.42 40721 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104908; rev:2;)
alert tcp $HOME_NET any -> 180.107.123.227 46139 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105033; rev:2;)
alert tcp $HOME_NET any -> 180.115.67.118 58208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105116; rev:2;)
alert tcp $HOME_NET any -> 180.115.168.174 34414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101884; rev:2;)
alert tcp $HOME_NET any -> 180.116.71.179 36941 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103727; rev:2;)
alert tcp $HOME_NET any -> 180.120.0.49 44129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106235; rev:2;)
alert tcp $HOME_NET any -> 182.146.222.251 41175 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104075; rev:2;)
alert tcp $HOME_NET any -> 182.240.8.122 58787 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105228; rev:2;)
alert tcp $HOME_NET any -> 182.240.10.30 58787 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106546; rev:2;)
alert tcp $HOME_NET any -> 183.12.173.166 35769 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105746; rev:2;)
alert tcp $HOME_NET any -> 183.23.136.70 54790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104267; rev:2;)
alert tcp $HOME_NET any -> 183.23.136.171 35951 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104132; rev:2;)
alert tcp $HOME_NET any -> 183.63.8.194 50991 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103724; rev:2;)
alert tcp $HOME_NET any -> 183.134.152.81 38332 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105226; rev:2;)
alert tcp $HOME_NET any -> 183.150.79.222 42629 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104529; rev:2;)
alert tcp $HOME_NET any -> 183.150.141.1 57127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103848; rev:2;)
alert tcp $HOME_NET any -> 183.150.205.192 57127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105225; rev:2;)
alert tcp $HOME_NET any -> 183.151.171.156 58331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103907; rev:2;)
alert tcp $HOME_NET any -> 183.151.174.249 60266 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106671; rev:2;)
alert tcp $HOME_NET any -> 183.153.114.172 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103847; rev:2;)
alert tcp $HOME_NET any -> 183.158.162.161 47195 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103846; rev:2;)
alert tcp $HOME_NET any -> 218.72.34.168 44366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104130; rev:2;)
alert tcp $HOME_NET any -> 220.177.11.172 54471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104030; rev:2;)
alert tcp $HOME_NET any -> 221.226.128.227 30002 (msg:"HOLLOWPOINT C2 adaptix"; reference:url,publicmosaic.com/indicators; sid:9100624; rev:2;)
alert tls $HOME_NET any -> 222.80.159.10 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"495081da58b2530b089cd1dc02269754f9940e98a295fac12117201e706012ab"; reference:url,publicmosaic.com/indicators; sid:9103417; rev:2;)
alert tcp $HOME_NET any -> 222.185.164.78 52993 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105048; rev:2;)
alert tcp $HOME_NET any -> 222.185.199.120 32826 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103649; rev:2;)
alert tcp $HOME_NET any -> 222.214.101.175 41596 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106750; rev:2;)
alert tcp $HOME_NET any -> 222.246.23.18 60522 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106088; rev:2;)
alert tcp $HOME_NET any -> 222.246.41.226 44313 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103841; rev:2;)
alert tcp $HOME_NET any -> 222.246.42.116 33992 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103722; rev:2;)
alert tcp $HOME_NET any -> 223.11.56.145 52220 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104263; rev:2;)
alert tcp $HOME_NET any -> 223.14.78.86 55197 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105591; rev:2;)