# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 11 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 9829 — https://publicmosaic.com/asn/9829
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 59.96.136.164 52219 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105607; rev:2;)
alert tcp $HOME_NET any -> 117.199.77.239 52881 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104820; rev:2;)
alert tcp $HOME_NET any -> 117.240.237.18 45919 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105057; rev:2;)
alert tcp $HOME_NET any -> 117.242.152.21 42166 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106149; rev:2;)
alert tcp $HOME_NET any -> 117.245.135.241 48870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106247; rev:2;)
alert tcp $HOME_NET any -> 117.245.139.85 44126 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104818; rev:2;)
alert tcp $HOME_NET any -> 117.245.141.241 45847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105640; rev:2;)
alert tcp $HOME_NET any -> 117.252.240.213 32809 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105407; rev:2;)
alert tcp $HOME_NET any -> 210.212.30.46 34158 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105366; rev:2;)
alert tcp $HOME_NET any -> 210.212.30.170 60531 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105703; rev:2;)
alert tcp $HOME_NET any -> 210.212.31.178 41770 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104843; rev:2;)