# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 35 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 55933 — https://publicmosaic.com/asn/55933
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 38.47.102.194 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100992; rev:2;)
alert tls $HOME_NET any -> 38.47.122.77 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1071e16e7aaf1efb3e1f484fe41cc5b389aba30448d72a4bdef0af92cdc90df0"; reference:url,publicmosaic.com/indicators; sid:9100404; rev:2;)
alert tcp $HOME_NET any -> 38.47.122.87 5432 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106081; rev:2;)
alert tls $HOME_NET any -> 45.221.118.46 8080 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"ccce2223024b1326fc5b417f223a9fabc2bd5039a45b7f53e2ed5ae2186687fd"; reference:url,publicmosaic.com/indicators; sid:9100857; rev:2;)
alert tls $HOME_NET any -> 45.221.118.46 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"afc341b7408f295bf0ba93d4c700a9674894d92202cbec30192244542f54ce7d"; reference:url,publicmosaic.com/indicators; sid:9100856; rev:2;)
alert tls $HOME_NET any -> 45.221.118.69 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3425ee411220b2caecd686b55570073d854ce1cf5a9e5f45fb3c707dd266f4fa"; reference:url,publicmosaic.com/indicators; sid:9104455; rev:2;)
alert tcp $HOME_NET any -> 45.221.118.69 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102216; rev:2;)
alert tcp $HOME_NET any -> 45.221.118.139 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9101577; rev:2;)
alert tls $HOME_NET any -> 45.221.118.139 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b320ef0d0336e953692773b254eea76f72f1e339182b98b5e8d286f462d0db15"; reference:url,publicmosaic.com/indicators; sid:9100048; rev:2;)
alert tcp $HOME_NET any -> 45.221.118.180 4889 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9103445; rev:2;)
alert tcp $HOME_NET any -> 93.177.77.228 8080 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102900; rev:2;)
alert tcp $HOME_NET any -> 93.177.77.228 8081 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102899; rev:2;)
alert tcp $HOME_NET any -> 103.115.64.31 8808 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102546; rev:2;)
alert tcp $HOME_NET any -> 103.118.247.231 50841 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102545; rev:2;)
alert tcp $HOME_NET any -> 103.197.25.8 8443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104155; rev:2;)
alert tls $HOME_NET any -> 103.237.92.116 443 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"4ee36a39737b59d36e0c1f9879f13588bc210fbe2f938b37f58ac0c12f8dc972"; reference:url,publicmosaic.com/indicators; sid:9101712; rev:2;)
alert tcp $HOME_NET any -> 103.237.92.116 8338 (msg:"HOLLOWPOINT C2 asyncrat"; reference:url,publicmosaic.com/indicators; sid:9103871; rev:2;)
alert tcp $HOME_NET any -> 123.254.106.168 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9100951; rev:2;)
alert tcp $HOME_NET any -> 123.254.106.168 8084 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9100952; rev:2;)
alert tcp $HOME_NET any -> 154.89.148.121 18084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105893; rev:2;)
alert tcp $HOME_NET any -> 156.254.6.103 2096 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106816; rev:2;)
alert tls $HOME_NET any -> 185.207.154.11 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5456f579674a55acf4bcc2b46ec6a5cbc9b270f12f147b6e8a5972fea578ffde"; reference:url,publicmosaic.com/indicators; sid:9100637; rev:2;)
alert tls $HOME_NET any -> 185.207.154.11 4848 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5456f579674a55acf4bcc2b46ec6a5cbc9b270f12f147b6e8a5972fea578ffde"; reference:url,publicmosaic.com/indicators; sid:9100453; rev:2;)
alert tls $HOME_NET any -> 185.227.152.231 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b902ebe6b057b2b251c7a5d04809ae88b0660db72dbf3c5830c4ad5a99740c6d"; reference:url,publicmosaic.com/indicators; sid:9104104; rev:2;)
alert tls $HOME_NET any -> 185.227.152.231 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"3cc5047d9f2e014b2c3bd3795867ce0bc28044ba446e87b9fd9b91aed3aa07ca"; reference:url,publicmosaic.com/indicators; sid:9105030; rev:2;)
alert tcp $HOME_NET any -> 185.242.233.212 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9106814; rev:2;)
alert tls $HOME_NET any -> 185.242.235.16 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"be412d387830e7567a52444060ccee08ca5f91c12740e92c242a1d72a8b100c2"; reference:url,publicmosaic.com/indicators; sid:9102036; rev:2;)
alert tls $HOME_NET any -> 185.242.235.16 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8e82badef755fb964e5e5d264a69f221a005f623bc3c5d19cbf9d5b88f5a6dd9"; reference:url,publicmosaic.com/indicators; sid:9101637; rev:2;)
alert tls $HOME_NET any -> 193.42.24.165 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6c3a8c914e550eef17a4b7069b5b3d5102acaad07c922aafc02ebcfc263b8984"; reference:url,publicmosaic.com/indicators; sid:9100781; rev:2;)
alert tcp $HOME_NET any -> 193.42.24.215 8084 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105682; rev:2;)
alert tcp $HOME_NET any -> 193.42.24.215 8085 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106417; rev:2;)
alert tls $HOME_NET any -> 194.32.149.129 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"1c08e36ec1515ac3189dbdad81484843e0f6fdda9201a4b5394267109f691ac7"; reference:url,publicmosaic.com/indicators; sid:9105031; rev:2;)
alert tcp $HOME_NET any -> 199.187.25.100 51001 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104603; rev:2;)
alert tcp $HOME_NET any -> 199.187.25.100 52660 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9104602; rev:2;)
alert tls $HOME_NET any -> 202.181.26.220 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"325f4da61419493254cd986f7c1707c886fe588da4d4df6a0865180b2b14b85a"; reference:url,publicmosaic.com/indicators; sid:9101777; rev:2;)