# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 569 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 4837 — https://publicmosaic.com/asn/4837
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 7
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.61.151.195 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105295; rev:2;)
alert tcp $HOME_NET any -> 1.61.202.234 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101880; rev:2;)
alert tls $HOME_NET any -> 27.10.61.55 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5edc16157c7b887458b353f4da358633f3e4399c6c112f2656e6af03f5b974f1"; reference:url,publicmosaic.com/indicators; sid:9100060; rev:2;)
alert tcp $HOME_NET any -> 27.12.220.94 58619 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106769; rev:2;)
alert tcp $HOME_NET any -> 27.202.53.216 45165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105771; rev:2;)
alert tcp $HOME_NET any -> 27.202.237.134 46617 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104988; rev:2;)
alert tcp $HOME_NET any -> 27.203.158.156 60406 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103745; rev:2;)
alert tcp $HOME_NET any -> 27.204.196.164 40053 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106768; rev:2;)
alert tcp $HOME_NET any -> 27.207.41.43 54515 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106370; rev:2;)
alert tcp $HOME_NET any -> 27.207.224.176 37565 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105382; rev:2;)
alert tcp $HOME_NET any -> 27.207.246.232 59924 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104744; rev:2;)
alert tcp $HOME_NET any -> 27.210.37.1 42263 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104921; rev:2;)
alert tcp $HOME_NET any -> 27.210.249.141 42418 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104734; rev:2;)
alert tcp $HOME_NET any -> 27.215.49.38 36855 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104748; rev:2;)
alert tcp $HOME_NET any -> 27.215.80.81 58529 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106719; rev:2;)
alert tcp $HOME_NET any -> 27.215.80.198 58347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104742; rev:2;)
alert tcp $HOME_NET any -> 27.215.84.127 37282 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105433; rev:2;)
alert tcp $HOME_NET any -> 27.215.85.29 36550 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104743; rev:2;)
alert tcp $HOME_NET any -> 27.215.124.53 58552 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106121; rev:2;)
alert tcp $HOME_NET any -> 27.215.138.54 34340 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106767; rev:2;)
alert tcp $HOME_NET any -> 27.215.210.140 47517 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105464; rev:2;)
alert tcp $HOME_NET any -> 27.215.210.163 49181 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105740; rev:2;)
alert tcp $HOME_NET any -> 27.215.212.148 34367 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106369; rev:2;)
alert tcp $HOME_NET any -> 27.217.2.130 36905 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9106368; rev:2;)
alert tcp $HOME_NET any -> 27.218.236.119 47733 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101879; rev:2;)
alert tcp $HOME_NET any -> 27.219.50.172 60907 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106545; rev:2;)
alert tcp $HOME_NET any -> 27.220.86.44 46545 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105102; rev:2;)
alert tcp $HOME_NET any -> 27.222.48.192 43573 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103744; rev:2;)
alert tcp $HOME_NET any -> 27.222.89.207 48083 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103743; rev:2;)
alert tcp $HOME_NET any -> 27.222.243.52 39549 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106279; rev:2;)
alert tcp $HOME_NET any -> 39.65.159.18 49124 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104892; rev:2;)
alert tcp $HOME_NET any -> 39.65.202.109 51237 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101878; rev:2;)
alert tcp $HOME_NET any -> 39.73.206.50 49985 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105770; rev:2;)
alert tcp $HOME_NET any -> 39.74.18.45 57987 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105722; rev:2;)
alert tcp $HOME_NET any -> 39.74.26.209 38746 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104741; rev:2;)
alert tcp $HOME_NET any -> 39.74.62.241 41341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105047; rev:2;)
alert tcp $HOME_NET any -> 39.74.114.50 59017 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104732; rev:2;)
alert tcp $HOME_NET any -> 39.79.47.37 48491 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105721; rev:2;)
alert tcp $HOME_NET any -> 39.79.68.65 34070 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106718; rev:2;)
alert tcp $HOME_NET any -> 39.80.60.21 60792 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103741; rev:2;)
alert tcp $HOME_NET any -> 39.81.37.15 40232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104739; rev:2;)
alert tcp $HOME_NET any -> 39.84.95.142 46029 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101877; rev:2;)
alert tcp $HOME_NET any -> 39.86.115.129 43919 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105444; rev:2;)
alert tcp $HOME_NET any -> 39.86.247.62 38819 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105387; rev:2;)
alert tcp $HOME_NET any -> 39.87.50.123 44919 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105422; rev:2;)
alert tcp $HOME_NET any -> 39.87.255.120 55663 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106275; rev:2;)
alert tcp $HOME_NET any -> 39.88.200.53 34933 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103740; rev:2;)
alert tcp $HOME_NET any -> 39.90.144.82 53918 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104740; rev:2;)
alert tcp $HOME_NET any -> 39.90.147.246 58169 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106384; rev:2;)
alert tcp $HOME_NET any -> 42.52.38.254 43443 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105384; rev:2;)
alert tcp $HOME_NET any -> 42.177.122.244 34345 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103860; rev:2;)
alert tcp $HOME_NET any -> 42.224.1.7 46113 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106543; rev:2;)
alert tcp $HOME_NET any -> 42.224.4.46 45846 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105458; rev:2;)
alert tcp $HOME_NET any -> 42.224.7.191 56165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105415; rev:2;)
alert tcp $HOME_NET any -> 42.224.64.165 33674 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105642; rev:2;)
alert tcp $HOME_NET any -> 42.224.64.204 53853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105608; rev:2;)
alert tcp $HOME_NET any -> 42.224.78.23 39508 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105410; rev:2;)
alert tcp $HOME_NET any -> 42.224.115.189 57237 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105457; rev:2;)
alert tcp $HOME_NET any -> 42.224.122.31 35568 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106274; rev:2;)
alert tcp $HOME_NET any -> 42.224.126.183 55514 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105273; rev:2;)
alert tcp $HOME_NET any -> 42.224.127.212 35568 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106542; rev:2;)
alert tcp $HOME_NET any -> 42.224.157.20 39780 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105272; rev:2;)
alert tcp $HOME_NET any -> 42.224.174.102 33440 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105416; rev:2;)
alert tcp $HOME_NET any -> 42.224.175.96 36970 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104738; rev:2;)
alert tcp $HOME_NET any -> 42.224.192.6 34023 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106716; rev:2;)
alert tcp $HOME_NET any -> 42.224.194.230 51692 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105046; rev:2;)
alert tcp $HOME_NET any -> 42.225.230.127 58769 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105845; rev:2;)
alert tcp $HOME_NET any -> 42.226.67.57 56542 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106120; rev:2;)
alert tcp $HOME_NET any -> 42.226.68.209 53631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105385; rev:2;)
alert tcp $HOME_NET any -> 42.226.79.45 41444 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105455; rev:2;)
alert tcp $HOME_NET any -> 42.227.1.51 47075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104736; rev:2;)
alert tcp $HOME_NET any -> 42.227.176.7 32988 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105270; rev:2;)
alert tcp $HOME_NET any -> 42.227.179.13 32824 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105409; rev:2;)
alert tcp $HOME_NET any -> 42.227.202.88 43796 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106541; rev:2;)
alert tcp $HOME_NET any -> 42.227.202.111 40117 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106367; rev:2;)
alert tcp $HOME_NET any -> 42.227.237.197 49632 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105348; rev:2;)
alert tcp $HOME_NET any -> 42.228.36.55 54911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105365; rev:2;)
alert tcp $HOME_NET any -> 42.228.124.66 38416 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105720; rev:2;)
alert tcp $HOME_NET any -> 42.228.216.218 55889 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104919; rev:2;)
alert tcp $HOME_NET any -> 42.228.236.172 34448 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106717; rev:2;)
alert tcp $HOME_NET any -> 42.228.239.154 34448 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105769; rev:2;)
alert tcp $HOME_NET any -> 42.228.245.61 34804 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106540; rev:2;)
alert tcp $HOME_NET any -> 42.229.190.158 59176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106366; rev:2;)
alert tcp $HOME_NET any -> 42.230.16.17 49033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105275; rev:2;)
alert tcp $HOME_NET any -> 42.230.55.38 54485 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106119; rev:2;)
alert tcp $HOME_NET any -> 42.231.70.134 33566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105739; rev:2;)
alert tcp $HOME_NET any -> 42.231.89.50 46000 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105768; rev:2;)
alert tcp $HOME_NET any -> 42.231.95.183 39082 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105767; rev:2;)
alert tcp $HOME_NET any -> 42.231.187.189 38441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106118; rev:2;)
alert tcp $HOME_NET any -> 42.231.202.85 57946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105463; rev:2;)
alert tcp $HOME_NET any -> 42.232.31.129 36569 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105274; rev:2;)
alert tcp $HOME_NET any -> 42.232.90.35 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105394; rev:2;)
alert tcp $HOME_NET any -> 42.232.225.98 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106156; rev:2;)
alert tcp $HOME_NET any -> 42.232.226.134 43284 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106539; rev:2;)
alert tcp $HOME_NET any -> 42.232.228.172 53412 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106273; rev:2;)
alert tcp $HOME_NET any -> 42.232.229.148 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105420; rev:2;)
alert tcp $HOME_NET any -> 42.233.91.171 56278 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105719; rev:2;)
alert tcp $HOME_NET any -> 42.233.106.146 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104725; rev:2;)
alert tcp $HOME_NET any -> 42.233.107.113 43544 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105432; rev:2;)
alert tcp $HOME_NET any -> 42.233.210.159 59519 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101876; rev:2;)
alert tcp $HOME_NET any -> 42.234.119.117 33571 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105718; rev:2;)
alert tcp $HOME_NET any -> 42.234.144.74 54788 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106538; rev:2;)
alert tcp $HOME_NET any -> 42.234.208.5 59424 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105381; rev:2;)
alert tcp $HOME_NET any -> 42.234.232.151 35677 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106537; rev:2;)
alert tcp $HOME_NET any -> 42.234.245.29 44847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106536; rev:2;)
alert tcp $HOME_NET any -> 42.234.246.38 55546 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105280; rev:2;)
alert tcp $HOME_NET any -> 42.235.36.83 54414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106535; rev:2;)
alert tcp $HOME_NET any -> 42.235.43.128 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106534; rev:2;)
alert tcp $HOME_NET any -> 42.235.48.143 51176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105045; rev:2;)
alert tcp $HOME_NET any -> 42.238.143.158 39299 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105467; rev:2;)
alert tcp $HOME_NET any -> 42.238.241.81 47417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106272; rev:2;)
alert tcp $HOME_NET any -> 42.238.242.50 35595 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105843; rev:2;)
alert tcp $HOME_NET any -> 42.239.143.201 52770 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105279; rev:2;)
alert tcp $HOME_NET any -> 42.239.150.66 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105766; rev:2;)
alert tcp $HOME_NET any -> 42.239.189.113 49093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106117; rev:2;)
alert tcp $HOME_NET any -> 42.239.225.72 37495 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105844; rev:2;)
alert tcp $HOME_NET any -> 42.239.230.18 57135 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106533; rev:2;)
alert tcp $HOME_NET any -> 58.22.18.152 33899 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103751; rev:2;)
alert tcp $HOME_NET any -> 58.22.210.127 46509 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106271; rev:2;)
alert tcp $HOME_NET any -> 60.6.62.96 59328 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106269; rev:2;)
alert tcp $HOME_NET any -> 60.211.59.115 55744 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106365; rev:2;)
alert tcp $HOME_NET any -> 60.215.197.174 38401 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101892; rev:2;)
alert tcp $HOME_NET any -> 60.216.131.62 43868 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101872; rev:2;)
alert tcp $HOME_NET any -> 60.217.23.146 7086 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102947; rev:2;)
alert tcp $HOME_NET any -> 60.217.23.146 7788 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9102946; rev:2;)
alert tls $HOME_NET any -> 60.217.23.146 7789 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"; reference:url,publicmosaic.com/indicators; sid:9102945; rev:2;)
alert tcp $HOME_NET any -> 61.52.3.67 41031 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106765; rev:2;)
alert tcp $HOME_NET any -> 61.52.33.22 43684 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106115; rev:2;)
alert tcp $HOME_NET any -> 61.52.34.120 58546 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106157; rev:2;)
alert tcp $HOME_NET any -> 61.52.37.73 50491 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105764; rev:2;)
alert tcp $HOME_NET any -> 61.52.55.252 40232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105044; rev:2;)
alert tcp $HOME_NET any -> 61.52.85.150 33059 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106268; rev:2;)
alert tcp $HOME_NET any -> 61.52.147.59 42873 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104918; rev:2;)
alert tcp $HOME_NET any -> 61.52.179.224 50718 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105605; rev:2;)
alert tcp $HOME_NET any -> 61.52.198.150 40687 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106267; rev:2;)
alert tcp $HOME_NET any -> 61.53.75.162 37419 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106715; rev:2;)
alert tcp $HOME_NET any -> 61.53.83.19 36154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105353; rev:2;)
alert tcp $HOME_NET any -> 61.53.87.97 37876 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106777; rev:2;)
alert tcp $HOME_NET any -> 61.53.90.140 41918 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105276; rev:2;)
alert tcp $HOME_NET any -> 61.53.91.238 55186 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105043; rev:2;)
alert tcp $HOME_NET any -> 61.53.95.155 37419 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105112; rev:2;)
alert tcp $HOME_NET any -> 61.53.103.200 46732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105278; rev:2;)
alert tcp $HOME_NET any -> 61.53.106.120 38038 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106529; rev:2;)
alert tcp $HOME_NET any -> 61.53.120.105 45884 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105453; rev:2;)
alert tcp $HOME_NET any -> 61.53.122.56 42123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105443; rev:2;)
alert tcp $HOME_NET any -> 61.53.150.15 38010 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105271; rev:2;)
alert tcp $HOME_NET any -> 61.53.151.142 41245 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105408; rev:2;)
alert tcp $HOME_NET any -> 61.53.152.228 38010 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106383; rev:2;)
alert tcp $HOME_NET any -> 61.53.236.32 49022 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106140; rev:2;)
alert tcp $HOME_NET any -> 61.54.167.178 52114 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105717; rev:2;)
alert tcp $HOME_NET any -> 61.54.233.14 52028 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105207; rev:2;)
alert tcp $HOME_NET any -> 101.29.22.214 59328 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104540; rev:2;)
alert tcp $HOME_NET any -> 101.30.245.217 37967 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104830; rev:2;)
alert tcp $HOME_NET any -> 101.74.52.251 15884 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106775; rev:2;)
alert tcp $HOME_NET any -> 112.109.197.47 41093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105264; rev:2;)
alert tcp $HOME_NET any -> 112.229.203.112 37340 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104826; rev:2;)
alert tcp $HOME_NET any -> 112.229.207.15 55943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106260; rev:2;)
alert tcp $HOME_NET any -> 112.231.205.143 43563 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106013; rev:2;)
alert tcp $HOME_NET any -> 112.237.49.125 43123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104079; rev:2;)
alert tcp $HOME_NET any -> 112.238.131.128 59841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105390; rev:2;)
alert tcp $HOME_NET any -> 112.240.165.27 60898 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105737; rev:2;)
alert tcp $HOME_NET any -> 112.242.152.173 55406 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105437; rev:2;)
alert tcp $HOME_NET any -> 112.246.19.248 41316 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105363; rev:2;)
alert tcp $HOME_NET any -> 112.248.17.144 35756 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105999; rev:2;)
alert tcp $HOME_NET any -> 112.248.81.132 53759 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106553; rev:2;)
alert tcp $HOME_NET any -> 112.248.105.114 40030 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106706; rev:2;)
alert tcp $HOME_NET any -> 112.248.108.140 41002 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105429; rev:2;)
alert tcp $HOME_NET any -> 112.248.115.39 40827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104829; rev:2;)
alert tcp $HOME_NET any -> 112.248.124.14 33320 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106380; rev:2;)
alert tcp $HOME_NET any -> 112.248.143.116 58363 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104823; rev:2;)
alert tcp $HOME_NET any -> 112.248.144.174 48971 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104956; rev:2;)
alert tcp $HOME_NET any -> 112.248.187.85 51786 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106112; rev:2;)
alert tcp $HOME_NET any -> 112.249.182.7 48054 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104916; rev:2;)
alert tcp $HOME_NET any -> 112.254.25.161 51093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103737; rev:2;)
alert tcp $HOME_NET any -> 112.254.26.64 51093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106705; rev:2;)
alert tcp $HOME_NET any -> 112.254.223.118 43542 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105350; rev:2;)
alert tcp $HOME_NET any -> 113.206.10.45 47047 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106523; rev:2;)
alert tcp $HOME_NET any -> 113.207.49.236 8000 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102467; rev:2;)
alert tcp $HOME_NET any -> 115.48.11.166 38942 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106522; rev:2;)
alert tcp $HOME_NET any -> 115.48.138.178 58694 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105716; rev:2;)
alert tcp $HOME_NET any -> 115.48.152.21 36033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106521; rev:2;)
alert tcp $HOME_NET any -> 115.48.162.240 53193 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104821; rev:2;)
alert tcp $HOME_NET any -> 115.48.163.214 53193 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105262; rev:2;)
alert tcp $HOME_NET any -> 115.48.238.241 42081 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105389; rev:2;)
alert tcp $HOME_NET any -> 115.49.3.97 34652 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105041; rev:2;)
alert tcp $HOME_NET any -> 115.49.7.34 40290 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105349; rev:2;)
alert tcp $HOME_NET any -> 115.49.63.152 38441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105362; rev:2;)
alert tcp $HOME_NET any -> 115.49.73.224 59218 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105435; rev:2;)
alert tcp $HOME_NET any -> 115.49.107.36 60965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106110; rev:2;)
alert tcp $HOME_NET any -> 115.49.119.203 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104824; rev:2;)
alert tcp $HOME_NET any -> 115.49.211.162 48058 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105736; rev:2;)
alert tcp $HOME_NET any -> 115.50.4.162 52152 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105735; rev:2;)
alert tcp $HOME_NET any -> 115.50.7.192 56498 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106257; rev:2;)
alert tcp $HOME_NET any -> 115.50.24.135 45123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105379; rev:2;)
alert tcp $HOME_NET any -> 115.50.66.35 54801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106284; rev:2;)
alert tcp $HOME_NET any -> 115.50.95.179 56165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105761; rev:2;)
alert tcp $HOME_NET any -> 115.50.229.130 55514 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106256; rev:2;)
alert tcp $HOME_NET any -> 115.51.37.116 49531 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105734; rev:2;)
alert tcp $HOME_NET any -> 115.51.63.165 47075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106109; rev:2;)
alert tcp $HOME_NET any -> 115.51.89.58 38582 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105261; rev:2;)
alert tcp $HOME_NET any -> 115.51.108.246 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104275; rev:2;)
alert tcp $HOME_NET any -> 115.51.123.229 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106702; rev:2;)
alert tcp $HOME_NET any -> 115.51.180.51 37431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103849; rev:2;)
alert tcp $HOME_NET any -> 115.52.17.57 47267 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105260; rev:2;)
alert tcp $HOME_NET any -> 115.52.42.203 48646 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106255; rev:2;)
alert tcp $HOME_NET any -> 115.52.111.131 47075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105421; rev:2;)
alert tcp $HOME_NET any -> 115.52.179.227 44220 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106760; rev:2;)
alert tcp $HOME_NET any -> 115.52.196.207 34556 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106363; rev:2;)
alert tcp $HOME_NET any -> 115.52.251.82 40573 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105760; rev:2;)
alert tcp $HOME_NET any -> 115.53.209.24 38958 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105259; rev:2;)
alert tcp $HOME_NET any -> 115.53.209.141 35634 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106520; rev:2;)
alert tcp $HOME_NET any -> 115.53.243.171 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104819; rev:2;)
alert tcp $HOME_NET any -> 115.53.247.98 42289 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106219; rev:2;)
alert tcp $HOME_NET any -> 115.54.108.81 38694 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105258; rev:2;)
alert tcp $HOME_NET any -> 115.54.133.39 59395 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105405; rev:2;)
alert tcp $HOME_NET any -> 115.55.28.24 54414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105759; rev:2;)
alert tcp $HOME_NET any -> 115.55.37.155 44748 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106701; rev:2;)
alert tcp $HOME_NET any -> 115.55.50.151 37533 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106254; rev:2;)
alert tcp $HOME_NET any -> 115.55.52.39 37533 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105257; rev:2;)
alert tcp $HOME_NET any -> 115.55.54.214 42911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105351; rev:2;)
alert tcp $HOME_NET any -> 115.55.59.170 60306 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106379; rev:2;)
alert tcp $HOME_NET any -> 115.55.62.144 54772 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105445; rev:2;)
alert tcp $HOME_NET any -> 115.55.63.143 48086 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106253; rev:2;)
alert tcp $HOME_NET any -> 115.55.131.82 52575 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106218; rev:2;)
alert tcp $HOME_NET any -> 115.55.151.48 39130 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106700; rev:2;)
alert tcp $HOME_NET any -> 115.55.158.73 35137 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105256; rev:2;)
alert tcp $HOME_NET any -> 115.55.173.148 44037 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105400; rev:2;)
alert tcp $HOME_NET any -> 115.55.174.71 44634 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104822; rev:2;)
alert tcp $HOME_NET any -> 115.55.178.118 42943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105040; rev:2;)
alert tcp $HOME_NET any -> 115.55.190.64 35735 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105715; rev:2;)
alert tcp $HOME_NET any -> 115.55.194.73 43155 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105352; rev:2;)
alert tcp $HOME_NET any -> 115.55.207.5 48069 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105456; rev:2;)
alert tcp $HOME_NET any -> 115.55.221.28 43660 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105417; rev:2;)
alert tcp $HOME_NET any -> 115.55.223.34 55375 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105039; rev:2;)
alert tcp $HOME_NET any -> 115.55.226.66 37950 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105603; rev:2;)
alert tcp $HOME_NET any -> 115.55.243.51 37495 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105038; rev:2;)
alert tcp $HOME_NET any -> 115.55.243.215 56839 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105840; rev:2;)
alert tcp $HOME_NET any -> 115.55.244.240 35253 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105403; rev:2;)
alert tcp $HOME_NET any -> 115.55.253.18 51853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105449; rev:2;)
alert tcp $HOME_NET any -> 115.56.12.39 52565 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105253; rev:2;)
alert tcp $HOME_NET any -> 115.56.96.161 54414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106108; rev:2;)
alert tcp $HOME_NET any -> 115.56.102.220 52578 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106519; rev:2;)
alert tcp $HOME_NET any -> 115.56.109.217 51650 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106217; rev:2;)
alert tcp $HOME_NET any -> 115.56.124.86 54294 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105839; rev:2;)
alert tcp $HOME_NET any -> 115.56.157.163 33718 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106699; rev:2;)
alert tcp $HOME_NET any -> 115.56.157.204 43031 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106698; rev:2;)
alert tcp $HOME_NET any -> 115.56.159.4 56622 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106252; rev:2;)
alert tcp $HOME_NET any -> 115.57.69.54 54406 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105758; rev:2;)
alert tcp $HOME_NET any -> 115.57.80.149 55734 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105406; rev:2;)
alert tcp $HOME_NET any -> 115.57.81.140 43219 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106251; rev:2;)
alert tcp $HOME_NET any -> 115.57.167.67 35149 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105757; rev:2;)
alert tcp $HOME_NET any -> 115.57.207.68 49426 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106759; rev:2;)
alert tcp $HOME_NET any -> 115.57.213.127 43509 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106697; rev:2;)
alert tcp $HOME_NET any -> 115.57.239.68 59935 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106518; rev:2;)
alert tcp $HOME_NET any -> 115.57.251.81 37477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105602; rev:2;)
alert tcp $HOME_NET any -> 115.57.253.17 53774 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105601; rev:2;)
alert tcp $HOME_NET any -> 115.57.254.136 42278 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105733; rev:2;)
alert tcp $HOME_NET any -> 115.58.80.45 58927 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105452; rev:2;)
alert tcp $HOME_NET any -> 115.58.80.135 41804 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106758; rev:2;)
alert tcp $HOME_NET any -> 115.58.86.52 34597 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104915; rev:2;)
alert tcp $HOME_NET any -> 115.58.91.176 40931 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105355; rev:2;)
alert tcp $HOME_NET any -> 115.58.95.71 41245 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105756; rev:2;)
alert tcp $HOME_NET any -> 115.58.97.98 60477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106517; rev:2;)
alert tcp $HOME_NET any -> 115.58.99.114 60477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104812; rev:2;)
alert tcp $HOME_NET any -> 115.58.128.53 38060 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105255; rev:2;)
alert tcp $HOME_NET any -> 115.58.178.178 33235 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106107; rev:2;)
alert tcp $HOME_NET any -> 115.58.180.245 33235 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104914; rev:2;)
alert tcp $HOME_NET any -> 115.58.253.176 36067 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106516; rev:2;)
alert tcp $HOME_NET any -> 115.59.231.52 49670 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106250; rev:2;)
alert tcp $HOME_NET any -> 115.60.209.34 51257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105391; rev:2;)
alert tcp $HOME_NET any -> 115.60.221.175 41921 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105732; rev:2;)
alert tcp $HOME_NET any -> 115.60.223.220 39065 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106152; rev:2;)
alert tcp $HOME_NET any -> 115.60.252.50 38555 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105838; rev:2;)
alert tcp $HOME_NET any -> 115.60.253.104 42814 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105755; rev:2;)
alert tcp $HOME_NET any -> 115.61.107.195 57147 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103772; rev:2;)
alert tcp $HOME_NET any -> 115.62.146.115 39533 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105641; rev:2;)
alert tcp $HOME_NET any -> 115.62.153.120 40604 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106150; rev:2;)
alert tcp $HOME_NET any -> 115.62.156.245 41068 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106106; rev:2;)
alert tcp $HOME_NET any -> 115.62.176.189 57183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106362; rev:2;)
alert tcp $HOME_NET any -> 115.62.181.25 57183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105402; rev:2;)
alert tcp $HOME_NET any -> 115.62.184.123 60624 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106249; rev:2;)
alert tcp $HOME_NET any -> 115.62.184.242 60983 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106248; rev:2;)
alert tcp $HOME_NET any -> 115.62.185.99 41114 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105714; rev:2;)
alert tcp $HOME_NET any -> 115.63.11.37 60272 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106515; rev:2;)
alert tcp $HOME_NET any -> 115.63.14.35 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105252; rev:2;)
alert tcp $HOME_NET any -> 115.63.14.195 42924 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105754; rev:2;)
alert tcp $HOME_NET any -> 115.63.84.231 59738 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105404; rev:2;)
alert tcp $HOME_NET any -> 115.63.86.151 59738 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105251; rev:2;)
alert tcp $HOME_NET any -> 115.63.144.10 52391 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104913; rev:2;)
alert tcp $HOME_NET any -> 115.63.146.71 34252 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106361; rev:2;)
alert tcp $HOME_NET any -> 115.63.146.138 55514 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106696; rev:2;)
alert tcp $HOME_NET any -> 115.63.206.246 47417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105753; rev:2;)
alert tcp $HOME_NET any -> 119.116.121.152 35357 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103850; rev:2;)
alert tcp $HOME_NET any -> 119.163.32.113 50032 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105250; rev:2;)
alert tcp $HOME_NET any -> 119.165.89.154 38309 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104814; rev:2;)
alert tcp $HOME_NET any -> 119.166.73.124 52203 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106509; rev:2;)
alert tcp $HOME_NET any -> 119.166.194.8 35798 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101865; rev:2;)
alert tcp $HOME_NET any -> 119.179.30.73 48215 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101883; rev:2;)
alert tcp $HOME_NET any -> 119.179.251.19 34111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105393; rev:2;)
alert tcp $HOME_NET any -> 119.179.254.3 36720 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105378; rev:2;)
alert tcp $HOME_NET any -> 119.180.244.119 42792 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105386; rev:2;)
alert tcp $HOME_NET any -> 119.184.4.100 48083 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105037; rev:2;)
alert tcp $HOME_NET any -> 119.185.132.53 44820 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105036; rev:2;)
alert tcp $HOME_NET any -> 119.185.241.242 59789 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105837; rev:2;)
alert tcp $HOME_NET any -> 119.187.237.130 43735 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105117; rev:2;)
alert tcp $HOME_NET any -> 119.189.215.204 39465 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106378; rev:2;)
alert tcp $HOME_NET any -> 119.189.238.246 36957 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106245; rev:2;)
alert tcp $HOME_NET any -> 119.189.249.202 39164 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106508; rev:2;)
alert tls $HOME_NET any -> 122.114.10.199 8001 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"83f1a41068402a3c14dfe51b8745527249c3888a7b6937dc339b028d00818e77"; reference:url,publicmosaic.com/indicators; sid:9103690; rev:2;)
alert tcp $HOME_NET any -> 122.114.177.241 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9105110; rev:2;)
alert tcp $HOME_NET any -> 122.139.13.133 53319 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106690; rev:2;)
alert tcp $HOME_NET any -> 122.139.18.141 39877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104135; rev:2;)
alert tcp $HOME_NET any -> 123.4.192.31 48226 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105364; rev:2;)
alert tcp $HOME_NET any -> 123.4.236.242 34736 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105244; rev:2;)
alert tcp $HOME_NET any -> 123.4.249.119 44171 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106505; rev:2;)
alert tcp $HOME_NET any -> 123.4.251.165 55576 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106757; rev:2;)
alert tcp $HOME_NET any -> 123.5.132.162 52455 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106504; rev:2;)
alert tcp $HOME_NET any -> 123.5.152.25 42329 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105401; rev:2;)
alert tcp $HOME_NET any -> 123.5.170.8 46113 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106241; rev:2;)
alert tcp $HOME_NET any -> 123.5.186.24 33440 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105361; rev:2;)
alert tcp $HOME_NET any -> 123.7.227.70 42873 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106550; rev:2;)
alert tcp $HOME_NET any -> 123.9.80.85 51154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105243; rev:2;)
alert tcp $HOME_NET any -> 123.9.192.163 56498 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105242; rev:2;)
alert tcp $HOME_NET any -> 123.10.225.139 46476 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105431; rev:2;)
alert tcp $HOME_NET any -> 123.11.7.143 37624 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105713; rev:2;)
alert tcp $HOME_NET any -> 123.11.11.52 48079 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105426; rev:2;)
alert tcp $HOME_NET any -> 123.11.64.164 34556 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105600; rev:2;)
alert tcp $HOME_NET any -> 123.11.67.64 36420 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106240; rev:2;)
alert tcp $HOME_NET any -> 123.11.70.219 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106126; rev:2;)
alert tcp $HOME_NET any -> 123.11.79.171 60170 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106359; rev:2;)
alert tcp $HOME_NET any -> 123.11.98.235 36589 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106756; rev:2;)
alert tcp $HOME_NET any -> 123.11.193.146 39743 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106358; rev:2;)
alert tcp $HOME_NET any -> 123.11.217.41 39743 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105599; rev:2;)
alert tcp $HOME_NET any -> 123.12.11.116 33633 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106503; rev:2;)
alert tcp $HOME_NET any -> 123.12.27.20 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105598; rev:2;)
alert tcp $HOME_NET any -> 123.12.31.141 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104815; rev:2;)
alert tcp $HOME_NET any -> 123.12.158.240 43156 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105450; rev:2;)
alert tcp $HOME_NET any -> 123.12.196.3 35706 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106689; rev:2;)
alert tcp $HOME_NET any -> 123.12.232.220 56476 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106688; rev:2;)
alert tcp $HOME_NET any -> 123.13.3.95 49993 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104809; rev:2;)
alert tcp $HOME_NET any -> 123.13.27.188 58344 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105731; rev:2;)
alert tcp $HOME_NET any -> 123.13.54.33 47505 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106687; rev:2;)
alert tcp $HOME_NET any -> 123.14.33.27 42713 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106755; rev:2;)
alert tcp $HOME_NET any -> 123.14.81.41 47055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104805; rev:2;)
alert tcp $HOME_NET any -> 123.14.85.183 47055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106104; rev:2;)
alert tcp $HOME_NET any -> 123.14.90.5 47055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106502; rev:2;)
alert tcp $HOME_NET any -> 123.14.123.154 33340 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105712; rev:2;)
alert tcp $HOME_NET any -> 123.14.215.182 57457 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106501; rev:2;)
alert tcp $HOME_NET any -> 123.14.252.181 54573 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105206; rev:2;)
alert tcp $HOME_NET any -> 123.15.67.95 37431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104271; rev:2;)
alert tcp $HOME_NET any -> 123.129.104.81 45165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104912; rev:2;)
alert tcp $HOME_NET any -> 123.129.130.4 34119 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105360; rev:2;)
alert tcp $HOME_NET any -> 123.129.130.19 38163 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104804; rev:2;)
alert tcp $HOME_NET any -> 123.129.130.148 58971 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106686; rev:2;)
alert tcp $HOME_NET any -> 123.129.131.98 48006 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106685; rev:2;)
alert tcp $HOME_NET any -> 123.129.134.33 47336 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105752; rev:2;)
alert tcp $HOME_NET any -> 123.132.166.255 41245 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101864; rev:2;)
alert tcp $HOME_NET any -> 123.132.245.94 33681 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104134; rev:2;)
alert tcp $HOME_NET any -> 123.234.191.177 42672 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106103; rev:2;)
alert tcp $HOME_NET any -> 124.131.4.86 37963 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105359; rev:2;)
alert tcp $HOME_NET any -> 124.131.139.209 57349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106216; rev:2;)
alert tcp $HOME_NET any -> 124.135.10.58 51825 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103650; rev:2;)
alert tcp $HOME_NET any -> 124.160.46.2 9929 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102415; rev:2;)
alert tcp $HOME_NET any -> 124.161.116.2 39053 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105296; rev:2;)
alert tcp $HOME_NET any -> 125.40.74.144 60027 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105451; rev:2;)
alert tcp $HOME_NET any -> 125.40.113.33 33011 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105380; rev:2;)
alert tcp $HOME_NET any -> 125.40.158.205 34448 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106160; rev:2;)
alert tcp $HOME_NET any -> 125.41.2.160 50746 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106102; rev:2;)
alert tcp $HOME_NET any -> 125.41.8.203 49314 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105035; rev:2;)
alert tcp $HOME_NET any -> 125.41.183.143 34893 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106215; rev:2;)
alert tcp $HOME_NET any -> 125.41.211.58 48188 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105440; rev:2;)
alert tcp $HOME_NET any -> 125.41.228.123 58883 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106754; rev:2;)
alert tcp $HOME_NET any -> 125.41.231.68 59866 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105239; rev:2;)
alert tcp $HOME_NET any -> 125.41.240.68 40451 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104808; rev:2;)
alert tcp $HOME_NET any -> 125.42.14.164 53770 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105439; rev:2;)
alert tcp $HOME_NET any -> 125.42.25.36 44732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105238; rev:2;)
alert tcp $HOME_NET any -> 125.43.5.41 34827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106500; rev:2;)
alert tcp $HOME_NET any -> 125.43.8.244 34827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101902; rev:2;)
alert tcp $HOME_NET any -> 125.43.36.129 38648 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105836; rev:2;)
alert tcp $HOME_NET any -> 125.43.37.95 40928 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105237; rev:2;)
alert tcp $HOME_NET any -> 125.43.39.192 56239 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105377; rev:2;)
alert tcp $HOME_NET any -> 125.43.43.232 50073 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106239; rev:2;)
alert tcp $HOME_NET any -> 125.43.45.149 33353 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105414; rev:2;)
alert tcp $HOME_NET any -> 125.43.105.61 50073 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105235; rev:2;)
alert tcp $HOME_NET any -> 125.43.105.193 34984 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104810; rev:2;)
alert tcp $HOME_NET any -> 125.43.226.173 40813 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104911; rev:2;)
alert tcp $HOME_NET any -> 125.44.39.235 49107 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105730; rev:2;)
alert tcp $HOME_NET any -> 125.44.60.118 38038 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105998; rev:2;)
alert tcp $HOME_NET any -> 125.44.190.92 60624 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106683; rev:2;)
alert tcp $HOME_NET any -> 125.44.214.233 54441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106147; rev:2;)
alert tcp $HOME_NET any -> 125.45.9.243 58985 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105751; rev:2;)
alert tcp $HOME_NET any -> 125.45.49.209 37734 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105376; rev:2;)
alert tcp $HOME_NET any -> 125.45.65.137 35631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106101; rev:2;)
alert tcp $HOME_NET any -> 125.46.198.106 33483 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106549; rev:2;)
alert tcp $HOME_NET any -> 125.47.85.70 56972 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106238; rev:2;)
alert tcp $HOME_NET any -> 125.47.87.230 46876 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106015; rev:2;)
alert tcp $HOME_NET any -> 125.47.225.19 52801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104910; rev:2;)
alert tcp $HOME_NET any -> 125.47.249.24 50285 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105454; rev:2;)
alert tls $HOME_NET any -> 139.212.143.218 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102226; rev:2;)
alert tcp $HOME_NET any -> 175.43.85.192 57642 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106159; rev:2;)
alert tcp $HOME_NET any -> 175.43.151.10 40697 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106282; rev:2;)
alert tls $HOME_NET any -> 175.43.223.195 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9194dbd48fd45a1a606477c5d14d703148d5f1e1346aa0dd7ae661dc5a66db0b"; reference:url,publicmosaic.com/indicators; sid:9100168; rev:2;)
alert tls $HOME_NET any -> 175.43.223.199 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9194dbd48fd45a1a606477c5d14d703148d5f1e1346aa0dd7ae661dc5a66db0b"; reference:url,publicmosaic.com/indicators; sid:9101522; rev:2;)
alert tls $HOME_NET any -> 175.43.223.201 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"9194dbd48fd45a1a606477c5d14d703148d5f1e1346aa0dd7ae661dc5a66db0b"; reference:url,publicmosaic.com/indicators; sid:9106122; rev:2;)
alert tcp $HOME_NET any -> 175.44.156.36 37033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103728; rev:2;)
alert tcp $HOME_NET any -> 175.153.135.75 53709 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106431; rev:2;)
alert tcp $HOME_NET any -> 182.112.13.124 56784 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104944; rev:2;)
alert tcp $HOME_NET any -> 182.112.28.50 36154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106234; rev:2;)
alert tcp $HOME_NET any -> 182.112.29.95 57957 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106430; rev:2;)
alert tcp $HOME_NET any -> 182.112.30.71 38364 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105375; rev:2;)
alert tcp $HOME_NET any -> 182.112.182.6 41117 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106372; rev:2;)
alert tcp $HOME_NET any -> 182.112.210.5 50682 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106678; rev:2;)
alert tcp $HOME_NET any -> 182.113.12.216 54485 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104793; rev:2;)
alert tcp $HOME_NET any -> 182.113.29.55 57658 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105115; rev:2;)
alert tcp $HOME_NET any -> 182.113.31.138 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106677; rev:2;)
alert tcp $HOME_NET any -> 182.113.35.132 45947 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106495; rev:2;)
alert tcp $HOME_NET any -> 182.113.37.210 57854 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106099; rev:2;)
alert tcp $HOME_NET any -> 182.113.199.122 58281 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104792; rev:2;)
alert tcp $HOME_NET any -> 182.113.200.66 35049 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106098; rev:2;)
alert tcp $HOME_NET any -> 182.114.32.165 37031 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106676; rev:2;)
alert tcp $HOME_NET any -> 182.114.248.139 32824 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105054; rev:2;)
alert tcp $HOME_NET any -> 182.116.14.167 42605 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106494; rev:2;)
alert tcp $HOME_NET any -> 182.116.36.188 37734 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105022; rev:2;)
alert tcp $HOME_NET any -> 182.116.38.177 53412 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105597; rev:2;)
alert tcp $HOME_NET any -> 182.116.64.244 57147 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105233; rev:2;)
alert tcp $HOME_NET any -> 182.116.112.64 57996 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105750; rev:2;)
alert tcp $HOME_NET any -> 182.116.119.23 38176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104791; rev:2;)
alert tcp $HOME_NET any -> 182.116.123.155 56622 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105232; rev:2;)
alert tcp $HOME_NET any -> 182.117.68.170 45884 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105374; rev:2;)
alert tcp $HOME_NET any -> 182.117.78.238 56888 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106429; rev:2;)
alert tcp $HOME_NET any -> 182.117.79.97 58056 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106097; rev:2;)
alert tcp $HOME_NET any -> 182.117.80.106 39130 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106428; rev:2;)
alert tcp $HOME_NET any -> 182.117.104.197 35137 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106233; rev:2;)
alert tcp $HOME_NET any -> 182.117.107.119 60480 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105729; rev:2;)
alert tcp $HOME_NET any -> 182.117.116.35 48461 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105373; rev:2;)
alert tcp $HOME_NET any -> 182.117.165.86 55309 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106548; rev:2;)
alert tcp $HOME_NET any -> 182.118.244.54 49806 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105448; rev:2;)
alert tcp $HOME_NET any -> 182.118.244.134 34417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106371; rev:2;)
alert tcp $HOME_NET any -> 182.118.247.217 34417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105231; rev:2;)
alert tcp $HOME_NET any -> 182.119.68.47 43814 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105438; rev:2;)
alert tcp $HOME_NET any -> 182.119.116.53 60344 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105372; rev:2;)
alert tcp $HOME_NET any -> 182.119.160.167 51257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105596; rev:2;)
alert tcp $HOME_NET any -> 182.119.162.49 51257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104790; rev:2;)
alert tcp $HOME_NET any -> 182.119.191.143 41594 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105436; rev:2;)
alert tcp $HOME_NET any -> 182.119.250.57 49635 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105447; rev:2;)
alert tcp $HOME_NET any -> 182.120.11.141 51655 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105987; rev:2;)
alert tcp $HOME_NET any -> 182.120.43.111 47591 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104032; rev:2;)
alert tcp $HOME_NET any -> 182.121.11.34 39191 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105358; rev:2;)
alert tcp $HOME_NET any -> 182.121.172.105 50668 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106232; rev:2;)
alert tcp $HOME_NET any -> 182.121.181.105 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105460; rev:2;)
alert tcp $HOME_NET any -> 182.121.236.181 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106146; rev:2;)
alert tcp $HOME_NET any -> 182.121.239.171 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105413; rev:2;)
alert tcp $HOME_NET any -> 182.122.144.142 52114 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105383; rev:2;)
alert tcp $HOME_NET any -> 182.122.193.170 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103769; rev:2;)
alert tcp $HOME_NET any -> 182.122.195.174 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105595; rev:2;)
alert tcp $HOME_NET any -> 182.122.232.225 45123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105702; rev:2;)
alert tcp $HOME_NET any -> 182.123.252.49 55576 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106493; rev:2;)
alert tcp $HOME_NET any -> 182.124.20.96 57190 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105441; rev:2;)
alert tcp $HOME_NET any -> 182.124.36.215 59176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105230; rev:2;)
alert tcp $HOME_NET any -> 182.124.164.121 44732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106231; rev:2;)
alert tcp $HOME_NET any -> 182.126.84.3 60500 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105434; rev:2;)
alert tcp $HOME_NET any -> 182.126.84.63 48055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106547; rev:2;)
alert tcp $HOME_NET any -> 182.126.87.82 58075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106492; rev:2;)
alert tcp $HOME_NET any -> 182.126.93.152 58339 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105749; rev:2;)
alert tcp $HOME_NET any -> 182.126.94.246 36732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106281; rev:2;)
alert tcp $HOME_NET any -> 182.126.95.127 35631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106427; rev:2;)
alert tcp $HOME_NET any -> 182.126.103.229 37256 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106675; rev:2;)
alert tcp $HOME_NET any -> 182.126.107.136 58026 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104907; rev:2;)
alert tcp $HOME_NET any -> 182.126.113.144 33201 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105728; rev:2;)
alert tcp $HOME_NET any -> 182.126.114.159 50568 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105229; rev:2;)
alert tcp $HOME_NET any -> 182.126.116.9 40413 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105711; rev:2;)
alert tcp $HOME_NET any -> 182.126.116.12 55360 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106096; rev:2;)
alert tcp $HOME_NET any -> 182.126.122.180 45536 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105430; rev:2;)
alert tcp $HOME_NET any -> 182.126.201.81 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106674; rev:2;)
alert tcp $HOME_NET any -> 182.126.201.152 43849 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105399; rev:2;)
alert tcp $HOME_NET any -> 182.126.248.175 50532 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106673; rev:2;)
alert tcp $HOME_NET any -> 182.127.5.251 38733 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106095; rev:2;)
alert tcp $HOME_NET any -> 182.127.31.102 46258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105834; rev:2;)
alert tcp $HOME_NET any -> 182.127.71.3 48418 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106672; rev:2;)
alert tcp $HOME_NET any -> 182.127.84.19 32929 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106491; rev:2;)
alert tcp $HOME_NET any -> 182.127.85.253 53702 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104787; rev:2;)
alert tcp $HOME_NET any -> 182.127.110.105 38298 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106145; rev:2;)
alert tcp $HOME_NET any -> 182.127.113.69 57854 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104867; rev:2;)
alert tcp $HOME_NET any -> 182.127.123.182 45947 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105748; rev:2;)
alert tcp $HOME_NET any -> 182.127.133.198 42943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106230; rev:2;)
alert tcp $HOME_NET any -> 182.127.152.170 43722 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105747; rev:2;)
alert tcp $HOME_NET any -> 182.127.160.17 58026 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105371; rev:2;)
alert tcp $HOME_NET any -> 182.127.164.233 54829 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106490; rev:2;)
alert tcp $HOME_NET any -> 182.127.165.77 43661 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105727; rev:2;)
alert tcp $HOME_NET any -> 182.127.166.145 47115 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104906; rev:2;)
alert tcp $HOME_NET any -> 182.127.168.147 41164 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105637; rev:2;)
alert tcp $HOME_NET any -> 182.127.191.30 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106489; rev:2;)
alert tcp $HOME_NET any -> 182.127.222.30 58000 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105357; rev:2;)
alert tcp $HOME_NET any -> 218.28.151.239 60344 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105743; rev:2;)
alert tcp $HOME_NET any -> 218.58.146.50 57477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104752; rev:2;)
alert tcp $HOME_NET any -> 219.154.185.65 55284 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106668; rev:2;)
alert tcp $HOME_NET any -> 219.155.80.213 57148 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106486; rev:2;)
alert tcp $HOME_NET any -> 219.155.81.73 57148 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105215; rev:2;)
alert tcp $HOME_NET any -> 219.155.86.225 52134 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105052; rev:2;)
alert tcp $HOME_NET any -> 219.155.104.50 48910 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105709; rev:2;)
alert tcp $HOME_NET any -> 219.155.130.51 35600 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106485; rev:2;)
alert tcp $HOME_NET any -> 219.155.130.122 46869 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105051; rev:2;)
alert tcp $HOME_NET any -> 219.155.192.25 45843 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106214; rev:2;)
alert tcp $HOME_NET any -> 219.155.200.86 54365 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105708; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.95 50456 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105370; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.117 50456 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105050; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.136 36366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105214; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.211 50456 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106667; rev:2;)
alert tcp $HOME_NET any -> 219.155.203.63 47994 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106666; rev:2;)
alert tcp $HOME_NET any -> 219.156.55.157 40201 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106774; rev:2;)
alert tcp $HOME_NET any -> 219.156.56.62 39663 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105832; rev:2;)
alert tcp $HOME_NET any -> 219.156.112.53 39981 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106125; rev:2;)
alert tcp $HOME_NET any -> 219.156.153.14 38441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106484; rev:2;)
alert tcp $HOME_NET any -> 219.156.181.248 55088 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105369; rev:2;)
alert tcp $HOME_NET any -> 219.157.16.109 59560 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105707; rev:2;)
alert tcp $HOME_NET any -> 219.157.18.29 33756 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105726; rev:2;)
alert tcp $HOME_NET any -> 219.157.63.126 54018 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105725; rev:2;)
alert tcp $HOME_NET any -> 219.157.63.238 58386 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105428; rev:2;)
alert tcp $HOME_NET any -> 219.157.161.10 60183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104902; rev:2;)
alert tcp $HOME_NET any -> 219.157.164.243 33354 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105465; rev:2;)
alert tcp $HOME_NET any -> 219.157.167.99 33777 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104129; rev:2;)
alert tcp $HOME_NET any -> 219.157.183.84 33148 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105368; rev:2;)
alert tcp $HOME_NET any -> 219.157.202.41 34653 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106665; rev:2;)
alert tcp $HOME_NET any -> 220.202.90.41 58445 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106227; rev:2;)
alert tcp $HOME_NET any -> 221.1.226.106 47537 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105397; rev:2;)
alert tcp $HOME_NET any -> 221.1.226.194 52984 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104751; rev:2;)
alert tcp $HOME_NET any -> 221.3.87.188 42241 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106226; rev:2;)
alert tcp $HOME_NET any -> 221.13.232.22 35790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104750; rev:2;)
alert tcp $HOME_NET any -> 221.14.15.139 35706 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106091; rev:2;)
alert tcp $HOME_NET any -> 221.14.52.245 47598 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105025; rev:2;)
alert tcp $HOME_NET any -> 221.14.107.151 48123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106483; rev:2;)
alert tcp $HOME_NET any -> 221.14.168.213 54946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105049; rev:2;)
alert tcp $HOME_NET any -> 221.14.171.98 54946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105356; rev:2;)
alert tcp $HOME_NET any -> 221.14.174.125 44223 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106482; rev:2;)
alert tcp $HOME_NET any -> 221.14.174.131 54946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105706; rev:2;)
alert tcp $HOME_NET any -> 221.15.9.33 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105831; rev:2;)
alert tcp $HOME_NET any -> 221.15.9.134 32847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106481; rev:2;)
alert tcp $HOME_NET any -> 221.15.12.42 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105705; rev:2;)
alert tcp $HOME_NET any -> 221.15.146.122 40487 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106752; rev:2;)
alert tcp $HOME_NET any -> 221.15.173.160 33401 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103764; rev:2;)
alert tcp $HOME_NET any -> 221.15.190.37 39478 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105446; rev:2;)
alert tcp $HOME_NET any -> 221.15.252.177 50496 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106225; rev:2;)
alert tcp $HOME_NET any -> 221.209.83.46 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106480; rev:2;)
alert tcp $HOME_NET any -> 222.134.172.157 35193 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105742; rev:2;)
alert tcp $HOME_NET any -> 222.134.173.235 41659 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105704; rev:2;)
alert tcp $HOME_NET any -> 222.136.109.202 50366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106426; rev:2;)
alert tcp $HOME_NET any -> 222.137.132.141 37017 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103842; rev:2;)
alert tcp $HOME_NET any -> 222.137.145.114 43346 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105741; rev:2;)
alert tcp $HOME_NET any -> 222.137.175.220 33354 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105396; rev:2;)
alert tcp $HOME_NET any -> 222.137.208.37 35853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105419; rev:2;)
alert tcp $HOME_NET any -> 222.137.209.172 35853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105211; rev:2;)
alert tcp $HOME_NET any -> 222.137.210.1 35853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106213; rev:2;)
alert tcp $HOME_NET any -> 222.137.235.158 37181 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105592; rev:2;)
alert tcp $HOME_NET any -> 222.138.213.176 34984 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105418; rev:2;)
alert tcp $HOME_NET any -> 222.139.34.67 44511 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105395; rev:2;)
alert tcp $HOME_NET any -> 222.139.36.162 57183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104745; rev:2;)
alert tcp $HOME_NET any -> 222.139.75.215 52350 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106479; rev:2;)
alert tcp $HOME_NET any -> 222.139.194.242 60965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106661; rev:2;)
alert tcp $HOME_NET any -> 222.140.180.172 33921 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105210; rev:2;)
alert tcp $HOME_NET any -> 222.140.183.127 55393 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105026; rev:2;)
alert tcp $HOME_NET any -> 222.141.122.247 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104746; rev:2;)
alert tcp $HOME_NET any -> 222.142.207.37 51650 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105209; rev:2;)
alert tcp $HOME_NET any -> 222.142.208.152 36145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106224; rev:2;)
alert tcp $HOME_NET any -> 222.142.227.31 39111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105367; rev:2;)
alert tcp $HOME_NET any -> 222.142.240.141 56223 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106660; rev:2;)
alert tcp $HOME_NET any -> 222.142.241.107 48515 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106751; rev:2;)
alert tcp $HOME_NET any -> 222.142.244.43 36726 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105724; rev:2;)
alert tcp $HOME_NET any -> 222.142.245.72 36694 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105635; rev:2;)
alert tcp $HOME_NET any -> 222.142.253.114 60129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106089; rev:2;)