# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 21 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 7713 — https://publicmosaic.com/asn/7713
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 5
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 36.64.184.26 46567 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104920; rev:2;)
alert tcp $HOME_NET any -> 36.64.184.26 51647 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106143; rev:2;)
alert tcp $HOME_NET any -> 36.68.93.208 57750 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106278; rev:2;)
alert tcp $HOME_NET any -> 36.69.76.83 47847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105846; rev:2;)
alert tcp $HOME_NET any -> 36.70.111.17 52592 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106386; rev:2;)
alert tcp $HOME_NET any -> 36.71.24.86 38254 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105064; rev:2;)
alert tcp $HOME_NET any -> 36.71.26.92 52208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105284; rev:2;)
alert tcp $HOME_NET any -> 36.77.230.229 47127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106004; rev:2;)
alert tcp $HOME_NET any -> 36.88.136.194 53727 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106544; rev:2;)
alert tcp $HOME_NET any -> 36.89.62.19 63814 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104986; rev:2;)
alert tcp $HOME_NET any -> 36.89.252.178 36257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106142; rev:2;)
alert tcp $HOME_NET any -> 36.93.147.195 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; reference:url,publicmosaic.com/indicators; sid:9104172; rev:2;)
alert tcp $HOME_NET any -> 110.136.98.236 48232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104946; rev:2;)
alert tcp $HOME_NET any -> 110.136.99.36 46081 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103855; rev:2;)
alert tcp $HOME_NET any -> 110.138.3.140 53454 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103877; rev:2;)
alert tcp $HOME_NET any -> 125.160.139.10 40058 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104035; rev:2;)
alert tcp $HOME_NET any -> 125.160.142.97 33577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106499; rev:2;)
alert tcp $HOME_NET any -> 180.244.47.60 40341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106680; rev:2;)
alert tcp $HOME_NET any -> 180.244.61.239 60849 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104268; rev:2;)
alert tcp $HOME_NET any -> 180.245.43.93 37596 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101860; rev:2;)
alert tcp $HOME_NET any -> 180.252.221.56 45321 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106679; rev:2;)