# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 50 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 45753 — https://publicmosaic.com/asn/45753
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 52.128.224.234 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102974; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.234 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104467; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.234 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102973; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.234 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102972; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104434; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102971; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102970; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.235 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102969; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102968; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102967; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102966; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.236 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102965; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102964; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102963; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102962; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.237 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102961; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102960; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102959; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 9090 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104018; rev:2;)
alert tcp $HOME_NET any -> 52.128.224.238 9191 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102958; rev:2;)
alert tls $HOME_NET any -> 103.70.77.226 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"34737b09206387ac5e0688619dc24f3aa3f1fcb214a2dbab83be1e3e5d358d70"; reference:url,publicmosaic.com/indicators; sid:9100361; rev:2;)
alert tcp $HOME_NET any -> 110.173.53.99 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102486; rev:2;)
alert tls $HOME_NET any -> 112.121.166.90 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8d63fd0c8387b846788cacab21a41d85052fcb4680e06139bcaa7ead371237dd"; reference:url,publicmosaic.com/indicators; sid:9103924; rev:2;)
alert tls $HOME_NET any -> 112.121.166.92 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8d63fd0c8387b846788cacab21a41d85052fcb4680e06139bcaa7ead371237dd"; reference:url,publicmosaic.com/indicators; sid:9101810; rev:2;)
alert tls $HOME_NET any -> 148.66.5.59 4443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3cc75ff995302462eb0fa4f074743f142c1b0d2d3ceb81b8292cc792cbba679f"; reference:url,publicmosaic.com/indicators; sid:9105779; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104544; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106056; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106055; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106054; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.122 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106053; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102372; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 56435 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103806; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106408; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106407; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.123 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106406; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104091; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106784; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106783; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.124 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106782; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102371; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 56435 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102370; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106052; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106051; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.125 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106050; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102369; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 56435 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102368; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106049; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60002 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106048; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60003 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106047; rev:2;)
alert tcp $HOME_NET any -> 148.66.17.126 60004 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106046; rev:2;)