# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 25 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 63949 — https://publicmosaic.com/asn/63949
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 104.64.210.147 80 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105611; rev:2;)
alert tcp $HOME_NET any -> 104.105.15.96 8443 (msg:"HOLLOWPOINT C2 evilginx"; reference:url,publicmosaic.com/indicators; sid:9101474; rev:2;)
alert tls $HOME_NET any -> 139.162.1.199 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"15568d9a085fde7267f743484a6443b35734685f9517626991d491c44d3fe4fb"; reference:url,publicmosaic.com/indicators; sid:9101718; rev:2;)
alert tls $HOME_NET any -> 139.162.1.199 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3e78b6adfeaaa4a0611e16ec19f7b10a81217c9d4aeac888e46426a255a1ec9d"; reference:url,publicmosaic.com/indicators; sid:9101626; rev:2;)
alert tls $HOME_NET any -> 139.162.113.221 64321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7c79be82d1f87ddea9dd8e0016943edd5543f7c4dd6e5ba3ab0a22f1c335d596"; reference:url,publicmosaic.com/indicators; sid:9103367; rev:2;)
alert tls $HOME_NET any -> 172.105.42.32 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f67f23d0cad7ff824b8a7504ab44bebcade2d4d7a15726d0bd50594710d3a302"; reference:url,publicmosaic.com/indicators; sid:9106388; rev:2;)
alert tls $HOME_NET any -> 172.105.103.223 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"de13703fcc480093c5a58017ddedc2895a58241dc6802805db6815058eb48a9d"; reference:url,publicmosaic.com/indicators; sid:9100304; rev:2;)
alert tls $HOME_NET any -> 172.232.97.189 50050 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"2cc7903b9f7dc87e59a32dbf2f608f8f7205a3e230084ac6b1588069fe8a17c4"; reference:url,publicmosaic.com/indicators; sid:9100791; rev:2;)
alert tcp $HOME_NET any -> 172.233.87.220 8080 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9106394; rev:2;)
alert tcp $HOME_NET any -> 172.233.87.220 9100 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9102697; rev:2;)
alert tls $HOME_NET any -> 172.233.97.159 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"e1411f04bf31f21d0ade4983c8e55767cd6c164fdbdf932473d9bdb170defd9b"; reference:url,publicmosaic.com/indicators; sid:9100553; rev:2;)
alert tcp $HOME_NET any -> 172.235.208.42 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105304; rev:2;)
alert tcp $HOME_NET any -> 172.235.208.160 443 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9106393; rev:2;)
alert tcp $HOME_NET any -> 172.235.208.160 3306 (msg:"HOLLOWPOINT malware distribution host vshell"; reference:url,publicmosaic.com/indicators; sid:9105472; rev:2;)
alert tls $HOME_NET any -> 172.236.10.230 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"50ed3450fbccc4787602e262e51518417e0d0d26445e29ec0241be004d48f197"; reference:url,publicmosaic.com/indicators; sid:9100804; rev:2;)
alert tls $HOME_NET any -> 172.236.215.250 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0f6cb6b6b931100f14e91cefbdd34bf7f04bd4c9dc417b35dab00a373647e3f9"; reference:url,publicmosaic.com/indicators; sid:9103679; rev:2;)
alert tls $HOME_NET any -> 172.237.72.64 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"bfb2b2fe4f09f57e09bb40bccbdffda812cb9d1cc6baf10110e8fd7efc68324e"; reference:url,publicmosaic.com/indicators; sid:9102038; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"29c4cb19385a4e410c03cec1a982527a09352afd2cf6bdd20c1e607d8ae1687b"; reference:url,publicmosaic.com/indicators; sid:9101242; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101235; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101236; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101234; rev:2;)
alert tls $HOME_NET any -> 172.239.45.42 81 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6b64a81be95746ba51510915028942acc29971d14f53604e05c9a05f079568dd"; reference:url,publicmosaic.com/indicators; sid:9100691; rev:2;)
alert tls $HOME_NET any -> 173.230.129.114 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8e6c70f30f0489162b62632b5ecabd7a9f01ed3e9d2762925f2382202bc5cd8a"; reference:url,publicmosaic.com/indicators; sid:9103836; rev:2;)
alert tcp $HOME_NET any -> 192.53.112.82 80 (msg:"HOLLOWPOINT C2 vshell"; reference:url,publicmosaic.com/indicators; sid:9102666; rev:2;)
alert tls $HOME_NET any -> 192.155.92.211 31337 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ad783a4be2aeff11eee8e8ec00fdc5cc8bd183cde940e9b039e006783ac6ef6a"; reference:url,publicmosaic.com/indicators; sid:9106818; rev:2;)