# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 42 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 54801 — https://publicmosaic.com/asn/54801
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 4
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 154.213.177.139 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dbc21df8f27373cf3e5549f350255c9357aa2309603e7daefd142c758c516386"; reference:url,publicmosaic.com/indicators; sid:9106637; rev:2;)
alert tls $HOME_NET any -> 154.213.177.154 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dbc21df8f27373cf3e5549f350255c9357aa2309603e7daefd142c758c516386"; reference:url,publicmosaic.com/indicators; sid:9101795; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103498; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8089 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103497; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8384 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105924; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8484 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105070; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8489 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103496; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8584 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9103495; rev:2;)
alert tcp $HOME_NET any -> 154.213.181.153 8589 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105923; rev:2;)
alert tcp $HOME_NET any -> 156.238.120.12 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104080; rev:2;)
alert tcp $HOME_NET any -> 156.238.120.13 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102725; rev:2;)
alert tcp $HOME_NET any -> 156.238.122.188 8801 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102724; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.37 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101669; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.37 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101668; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.53 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101679; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.99 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102603; rev:2;)
alert tcp $HOME_NET any -> 207.56.11.49 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102602; rev:2;)
alert tcp $HOME_NET any -> 207.56.20.68 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104303; rev:2;)
alert tls $HOME_NET any -> 207.56.26.118 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5f6e1c65143615f14174c1e5786fafd7571f8b54fd6684d68f217d528f2f2d09"; reference:url,publicmosaic.com/indicators; sid:9103353; rev:2;)
alert tls $HOME_NET any -> 207.56.28.76 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46d505ee1c7a48ee395088b37e4cbc09712cc076bbb1c82de8c0cbbb07adb018"; reference:url,publicmosaic.com/indicators; sid:9101774; rev:2;)
alert tls $HOME_NET any -> 207.56.28.84 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46d505ee1c7a48ee395088b37e4cbc09712cc076bbb1c82de8c0cbbb07adb018"; reference:url,publicmosaic.com/indicators; sid:9101773; rev:2;)
alert tls $HOME_NET any -> 207.56.28.189 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"949e6ca0bc33f8be4bcf5e01f0719ffe0f9f4ac227581f64912d5ae143a0d40b"; reference:url,publicmosaic.com/indicators; sid:9106633; rev:2;)
alert tls $HOME_NET any -> 207.56.28.225 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"949e6ca0bc33f8be4bcf5e01f0719ffe0f9f4ac227581f64912d5ae143a0d40b"; reference:url,publicmosaic.com/indicators; sid:9105803; rev:2;)
alert tls $HOME_NET any -> 207.56.30.198 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a5f1cd427b6e5db84de6a765e75eb11293fc5821a5a250dbb15cfd9d4b8fab05"; reference:url,publicmosaic.com/indicators; sid:9101771; rev:2;)
alert tls $HOME_NET any -> 207.56.30.219 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a5f1cd427b6e5db84de6a765e75eb11293fc5821a5a250dbb15cfd9d4b8fab05"; reference:url,publicmosaic.com/indicators; sid:9101769; rev:2;)
alert tls $HOME_NET any -> 207.56.119.21 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8302f74a483379cb2574c161e37b6593529d6010d82b3fd32141a0300bb5197c"; reference:url,publicmosaic.com/indicators; sid:9101770; rev:2;)
alert tls $HOME_NET any -> 207.56.119.35 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d798059ba575718e4b068de1c824fa2db24ff411ce58bbfb958a27321e7fa56b"; reference:url,publicmosaic.com/indicators; sid:9101772; rev:2;)
alert tls $HOME_NET any -> 207.56.119.48 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8412a1de75aad90b989069cd4d09fc97c5a8fb77194317cb427788bed05e8514"; reference:url,publicmosaic.com/indicators; sid:9101761; rev:2;)
alert tls $HOME_NET any -> 207.56.119.80 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"e0db6c08cfb26c614ac9ea7b3306949eb3db5c24f04e06a735aa8001e0a8f962"; reference:url,publicmosaic.com/indicators; sid:9101766; rev:2;)
alert tls $HOME_NET any -> 207.56.119.82 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d798059ba575718e4b068de1c824fa2db24ff411ce58bbfb958a27321e7fa56b"; reference:url,publicmosaic.com/indicators; sid:9101768; rev:2;)
alert tls $HOME_NET any -> 207.56.119.92 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1fd0b98e60895cd6e4207376960d21da27cf0433cef663d0204b74cfffdc1649"; reference:url,publicmosaic.com/indicators; sid:9101767; rev:2;)
alert tls $HOME_NET any -> 207.56.119.96 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"98da1e2d366061f244a05c636fe5620b5948b03cf10637cf977f76d52d14f688"; reference:url,publicmosaic.com/indicators; sid:9101759; rev:2;)
alert tls $HOME_NET any -> 207.56.119.123 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8302f74a483379cb2574c161e37b6593529d6010d82b3fd32141a0300bb5197c"; reference:url,publicmosaic.com/indicators; sid:9101760; rev:2;)
alert tls $HOME_NET any -> 207.56.119.139 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8412a1de75aad90b989069cd4d09fc97c5a8fb77194317cb427788bed05e8514"; reference:url,publicmosaic.com/indicators; sid:9101765; rev:2;)
alert tls $HOME_NET any -> 207.56.119.183 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7da07b37260b9396b553ab51baf46e9e3439227ac5570730c0afba36621808d8"; reference:url,publicmosaic.com/indicators; sid:9106350; rev:2;)
alert tls $HOME_NET any -> 207.56.119.194 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7da07b37260b9396b553ab51baf46e9e3439227ac5570730c0afba36621808d8"; reference:url,publicmosaic.com/indicators; sid:9101763; rev:2;)
alert tls $HOME_NET any -> 207.56.119.200 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"e0db6c08cfb26c614ac9ea7b3306949eb3db5c24f04e06a735aa8001e0a8f962"; reference:url,publicmosaic.com/indicators; sid:9101758; rev:2;)
alert tcp $HOME_NET any -> 207.56.119.239 8889 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105973; rev:2;)
alert tls $HOME_NET any -> 207.56.138.49 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"aceb945117e84094314066fca5ffcc779b30d13a477c5e3b75f610ce02e62116"; reference:url,publicmosaic.com/indicators; sid:9101762; rev:2;)
alert tls $HOME_NET any -> 207.56.138.80 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"359fd01dc83f1770c49176c861fce1e6a993f88c1b9f43e3214fadcb8e201f25"; reference:url,publicmosaic.com/indicators; sid:9106632; rev:2;)
alert tls $HOME_NET any -> 207.56.138.97 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"aceb945117e84094314066fca5ffcc779b30d13a477c5e3b75f610ce02e62116"; reference:url,publicmosaic.com/indicators; sid:9101764; rev:2;)
alert tls $HOME_NET any -> 207.56.138.140 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"359fd01dc83f1770c49176c861fce1e6a993f88c1b9f43e3214fadcb8e201f25"; reference:url,publicmosaic.com/indicators; sid:9101757; rev:2;)