# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 62 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family chisel — https://publicmosaic.com/c2/chisel
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 12
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.14.136.252 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103912; rev:2;)
alert tcp $HOME_NET any -> 3.39.249.68 8888 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103974; rev:2;)
alert tcp $HOME_NET any -> 14.248.83.53 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105781; rev:2;)
alert tcp $HOME_NET any -> 45.84.220.85 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105780; rev:2;)
alert tcp $HOME_NET any -> 45.115.27.16 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9106355; rev:2;)
alert tcp $HOME_NET any -> 45.128.156.62 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9102525; rev:2;)
alert tcp $HOME_NET any -> 46.101.85.81 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101620; rev:2;)
alert tcp $HOME_NET any -> 49.232.60.192 4443 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104201; rev:2;)
alert tcp $HOME_NET any -> 51.89.172.77 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105786; rev:2;)
alert tcp $HOME_NET any -> 54.39.99.113 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105785; rev:2;)
alert tcp $HOME_NET any -> 81.70.219.240 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103981; rev:2;)
alert tcp $HOME_NET any -> 82.208.23.183 80 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104001; rev:2;)
alert tcp $HOME_NET any -> 85.155.186.2 8443 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103970; rev:2;)
alert tcp $HOME_NET any -> 89.116.24.9 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104205; rev:2;)
alert tcp $HOME_NET any -> 101.34.223.83 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103893; rev:2;)
alert tcp $HOME_NET any -> 103.157.96.213 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104147; rev:2;)
alert tcp $HOME_NET any -> 103.169.3.162 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104234; rev:2;)
alert tcp $HOME_NET any -> 103.183.47.154 8888 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104199; rev:2;)
alert tcp $HOME_NET any -> 103.195.101.227 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9102518; rev:2;)
alert tcp $HOME_NET any -> 104.248.78.108 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101618; rev:2;)
alert tcp $HOME_NET any -> 106.52.155.224 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103894; rev:2;)
alert tcp $HOME_NET any -> 106.52.179.216 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103982; rev:2;)
alert tcp $HOME_NET any -> 106.54.59.209 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103910; rev:2;)
alert tcp $HOME_NET any -> 106.54.206.77 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103911; rev:2;)
alert tcp $HOME_NET any -> 109.199.102.87 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105784; rev:2;)
alert tcp $HOME_NET any -> 111.229.182.88 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103926; rev:2;)
alert tcp $HOME_NET any -> 113.31.118.180 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104229; rev:2;)
alert tcp $HOME_NET any -> 114.132.46.254 9443 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104183; rev:2;)
alert tcp $HOME_NET any -> 116.206.196.38 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105782; rev:2;)
alert tcp $HOME_NET any -> 123.207.198.218 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103892; rev:2;)
alert tcp $HOME_NET any -> 124.221.123.163 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103927; rev:2;)
alert tcp $HOME_NET any -> 138.68.63.206 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101699; rev:2;)
alert tcp $HOME_NET any -> 143.198.84.113 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101609; rev:2;)
alert tcp $HOME_NET any -> 143.244.214.44 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101592; rev:2;)
alert tcp $HOME_NET any -> 146.190.127.173 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101702; rev:2;)
alert tcp $HOME_NET any -> 146.190.190.101 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103861; rev:2;)
alert tcp $HOME_NET any -> 147.45.124.125 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9100921; rev:2;)
alert tcp $HOME_NET any -> 147.45.124.142 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101446; rev:2;)
alert tcp $HOME_NET any -> 147.45.124.178 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101445; rev:2;)
alert tcp $HOME_NET any -> 147.45.124.185 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105774; rev:2;)
alert tcp $HOME_NET any -> 147.45.125.8 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105775; rev:2;)
alert tcp $HOME_NET any -> 157.230.114.167 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101701; rev:2;)
alert tcp $HOME_NET any -> 157.245.246.46 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101682; rev:2;)
alert tcp $HOME_NET any -> 159.65.100.153 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103862; rev:2;)
alert tcp $HOME_NET any -> 163.172.66.212 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105783; rev:2;)
alert tcp $HOME_NET any -> 164.92.148.104 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101591; rev:2;)
alert tcp $HOME_NET any -> 164.92.253.168 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101617; rev:2;)
alert tcp $HOME_NET any -> 165.232.140.50 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101593; rev:2;)
alert tcp $HOME_NET any -> 165.245.181.236 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101594; rev:2;)
alert tcp $HOME_NET any -> 167.71.93.66 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9103863; rev:2;)
alert tcp $HOME_NET any -> 167.71.138.56 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101683; rev:2;)
alert tcp $HOME_NET any -> 170.64.178.133 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101595; rev:2;)
alert tcp $HOME_NET any -> 185.143.238.36 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105773; rev:2;)
alert tcp $HOME_NET any -> 185.219.7.20 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105777; rev:2;)
alert tcp $HOME_NET any -> 185.236.26.212 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101443; rev:2;)
alert tcp $HOME_NET any -> 185.242.233.212 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9106814; rev:2;)
alert tcp $HOME_NET any -> 185.250.180.228 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105778; rev:2;)
alert tcp $HOME_NET any -> 188.166.213.130 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101619; rev:2;)
alert tcp $HOME_NET any -> 193.17.183.131 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101448; rev:2;)
alert tcp $HOME_NET any -> 193.46.217.166 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9105776; rev:2;)
alert tcp $HOME_NET any -> 206.189.141.228 8000 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9101621; rev:2;)
alert tcp $HOME_NET any -> 206.189.252.227 80 (msg:"HOLLOWPOINT exposed tool chisel"; reference:url,publicmosaic.com/indicators; sid:9104191; rev:2;)