# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 26 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family darksword — https://publicmosaic.com/c2/darksword
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 23.27.245.118 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106441; rev:2;)
alert tcp $HOME_NET any -> 23.132.132.136 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105972; rev:2;)
alert tcp $HOME_NET any -> 38.181.56.130 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105971; rev:2;)
alert tls $HOME_NET any -> 43.98.165.114 443 (msg:"HOLLOWPOINT C2 darksword"; tls.cert_fingerprint; content:"fb5c28e93171fb1abde70a325101b1d8fdcf13e4892ada51042fabcb4f02bb71"; reference:url,publicmosaic.com/indicators; sid:9105964; rev:2;)
alert tcp $HOME_NET any -> 43.108.57.27 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105966; rev:2;)
alert tcp $HOME_NET any -> 43.255.28.208 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106641; rev:2;)
alert tcp $HOME_NET any -> 45.192.109.43 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105962; rev:2;)
alert tcp $HOME_NET any -> 47.236.83.240 8899 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105961; rev:2;)
alert tcp $HOME_NET any -> 89.125.43.163 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106442; rev:2;)
alert tcp $HOME_NET any -> 101.55.59.114 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106642; rev:2;)
alert tcp $HOME_NET any -> 103.52.153.142 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105965; rev:2;)
alert tcp $HOME_NET any -> 103.254.148.169 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105980; rev:2;)
alert tcp $HOME_NET any -> 107.175.49.181 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105979; rev:2;)
alert tcp $HOME_NET any -> 112.213.103.111 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105963; rev:2;)
alert tcp $HOME_NET any -> 120.26.184.232 80 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105978; rev:2;)
alert tls $HOME_NET any -> 154.12.80.232 8888 (msg:"HOLLOWPOINT C2 darksword"; tls.cert_fingerprint; content:"5b53d54fa21a7dfe8670d037145a8c453fc0635a473b791af8897d1931b803b9"; reference:url,publicmosaic.com/indicators; sid:9105968; rev:2;)
alert tcp $HOME_NET any -> 154.23.141.210 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105977; rev:2;)
alert tcp $HOME_NET any -> 154.36.167.198 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106804; rev:2;)
alert tcp $HOME_NET any -> 162.251.94.208 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105969; rev:2;)
alert tcp $HOME_NET any -> 167.104.101.115 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9106440; rev:2;)
alert tcp $HOME_NET any -> 191.40.37.39 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105976; rev:2;)
alert tcp $HOME_NET any -> 202.162.99.229 8888 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105970; rev:2;)
alert tcp $HOME_NET any -> 206.238.20.42 80 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105975; rev:2;)
alert tcp $HOME_NET any -> 206.238.20.42 3000 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105967; rev:2;)
alert tcp $HOME_NET any -> 207.56.119.239 8889 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105973; rev:2;)
alert tcp $HOME_NET any -> 207.148.92.205 8889 (msg:"HOLLOWPOINT C2 darksword"; reference:url,publicmosaic.com/indicators; sid:9105974; rev:2;)