# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 83 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family dcrat — https://publicmosaic.com/c2/dcrat
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 3.67.112.102 27452 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101677; rev:2;)
alert tcp $HOME_NET any -> 3.127.181.115 27452 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101676; rev:2;)
alert tls $HOME_NET any -> 12.187.175.73 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9103826; rev:2;)
alert tls $HOME_NET any -> 12.202.180.13 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9104514; rev:2;)
alert tcp $HOME_NET any -> 23.95.217.139 6689 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103302; rev:2;)
alert tls $HOME_NET any -> 27.124.17.151 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100059; rev:2;)
alert tls $HOME_NET any -> 27.124.17.164 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100057; rev:2;)
alert tls $HOME_NET any -> 27.124.17.173 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100058; rev:2;)
alert tcp $HOME_NET any -> 31.59.118.107 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104689; rev:2;)
alert tcp $HOME_NET any -> 38.60.252.124 80 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101147; rev:2;)
alert tcp $HOME_NET any -> 38.60.252.124 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101146; rev:2;)
alert tcp $HOME_NET any -> 43.248.99.208 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103825; rev:2;)
alert tcp $HOME_NET any -> 45.59.120.82 7001 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101678; rev:2;)
alert tcp $HOME_NET any -> 45.74.34.32 1995 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101675; rev:2;)
alert tcp $HOME_NET any -> 45.81.115.197 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104684; rev:2;)
alert tcp $HOME_NET any -> 45.133.180.138 6432 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9105983; rev:2;)
alert tcp $HOME_NET any -> 45.142.30.100 7777 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106072; rev:2;)
alert tcp $HOME_NET any -> 45.147.28.92 4449 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103611; rev:2;)
alert tcp $HOME_NET any -> 45.192.105.44 8080 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103824; rev:2;)
alert tcp $HOME_NET any -> 45.192.105.203 8000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103823; rev:2;)
alert tcp $HOME_NET any -> 45.192.169.254 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101144; rev:2;)
alert tcp $HOME_NET any -> 45.194.37.207 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106629; rev:2;)
alert tcp $HOME_NET any -> 45.202.0.24 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106741; rev:2;)
alert tls $HOME_NET any -> 46.151.182.17 5555 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"ea6d84a6d0d2b6fc9cbe474af26dc2f9893050937549119665a192d03f7f9158"; reference:url,publicmosaic.com/indicators; sid:9103822; rev:2;)
alert tcp $HOME_NET any -> 46.246.84.8 2003 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106457; rev:2;)
alert tcp $HOME_NET any -> 46.246.84.8 6490 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106456; rev:2;)
alert tls $HOME_NET any -> 47.98.129.153 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100045; rev:2;)
alert tcp $HOME_NET any -> 64.89.160.44 7777 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104512; rev:2;)
alert tcp $HOME_NET any -> 64.89.161.65 4444 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101674; rev:2;)
alert tls $HOME_NET any -> 66.175.236.12 5060 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"5d4eca00e629a01c4c611ee28eff4cebfb001789af9edc3d8e56ffde9ce541b7"; reference:url,publicmosaic.com/indicators; sid:9101573; rev:2;)
alert tls $HOME_NET any -> 79.110.49.227 30120 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a6aaa3064f7e438a1bceecce8c8519e61fb4492fba03016673a00313f1d4d28d"; reference:url,publicmosaic.com/indicators; sid:9103821; rev:2;)
alert tcp $HOME_NET any -> 81.70.105.7 4449 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103373; rev:2;)
alert tcp $HOME_NET any -> 82.23.246.148 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104682; rev:2;)
alert tcp $HOME_NET any -> 82.23.246.160 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101673; rev:2;)
alert tcp $HOME_NET any -> 82.23.246.160 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101672; rev:2;)
alert tls $HOME_NET any -> 91.92.241.38 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"96ab27fd0397c6ce461c71947490e9c3c5c2bacb0f58afd5af50b9fdf23e24b7"; reference:url,publicmosaic.com/indicators; sid:9100423; rev:2;)
alert tcp $HOME_NET any -> 91.229.239.129 4449 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103660; rev:2;)
alert tcp $HOME_NET any -> 91.232.103.99 433 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9105095; rev:2;)
alert tcp $HOME_NET any -> 94.156.250.190 3311 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9105101; rev:2;)
alert tcp $HOME_NET any -> 102.220.160.117 80 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104691; rev:2;)
alert tls $HOME_NET any -> 102.220.160.231 80 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"015089aba39c0f75b8f0e2752b131fa044de9eed484a9010a374f3e5a6bae889"; reference:url,publicmosaic.com/indicators; sid:9100125; rev:2;)
alert tls $HOME_NET any -> 102.220.160.231 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"015089aba39c0f75b8f0e2752b131fa044de9eed484a9010a374f3e5a6bae889"; reference:url,publicmosaic.com/indicators; sid:9100124; rev:2;)
alert tls $HOME_NET any -> 103.17.185.70 5555 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"c206fbbb02bca6b5358fb4f21d3837ecb6f7d752821a5236ffda42bf84decd15"; reference:url,publicmosaic.com/indicators; sid:9103820; rev:2;)
alert tcp $HOME_NET any -> 103.98.18.238 3333 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9100879; rev:2;)
alert tcp $HOME_NET any -> 103.98.18.238 8660 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101192; rev:2;)
alert tls $HOME_NET any -> 103.199.100.170 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100122; rev:2;)
alert tls $HOME_NET any -> 103.199.100.171 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100117; rev:2;)
alert tls $HOME_NET any -> 103.199.100.172 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100119; rev:2;)
alert tls $HOME_NET any -> 103.199.100.173 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100121; rev:2;)
alert tls $HOME_NET any -> 103.199.100.174 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100118; rev:2;)
alert tcp $HOME_NET any -> 103.236.70.158 8000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9102279; rev:2;)
alert tls $HOME_NET any -> 108.252.227.16 3001 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"6dc0db7fd80e8b4012130a266f6b50f5e0e66ef52e2abaac3e567281efb96b4d"; reference:url,publicmosaic.com/indicators; sid:9104046; rev:2;)
alert tcp $HOME_NET any -> 110.42.6.163 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104073; rev:2;)
alert tcp $HOME_NET any -> 115.42.60.122 5440 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106082; rev:2;)
alert tcp $HOME_NET any -> 115.42.60.122 7912 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9102278; rev:2;)
alert tcp $HOME_NET any -> 124.156.169.80 8000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103819; rev:2;)
alert tcp $HOME_NET any -> 124.198.132.77 1458 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101680; rev:2;)
alert tcp $HOME_NET any -> 124.220.49.140 8000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103818; rev:2;)
alert tcp $HOME_NET any -> 128.90.105.118 8624 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101183; rev:2;)
alert tcp $HOME_NET any -> 129.151.142.36 3391 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104450; rev:2;)
alert tcp $HOME_NET any -> 130.12.181.96 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9102277; rev:2;)
alert tcp $HOME_NET any -> 134.122.168.166 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101681; rev:2;)
alert tcp $HOME_NET any -> 141.94.121.162 6060 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9102276; rev:2;)
alert tls $HOME_NET any -> 141.94.121.162 6663 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a19ec99e1870fd21a03c185ab37075100246ba7007b47ccac16d706c19839a8e"; reference:url,publicmosaic.com/indicators; sid:9100178; rev:2;)
alert tls $HOME_NET any -> 141.94.121.162 6667 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a19ec99e1870fd21a03c185ab37075100246ba7007b47ccac16d706c19839a8e"; reference:url,publicmosaic.com/indicators; sid:9100177; rev:2;)
alert tcp $HOME_NET any -> 141.94.121.162 6668 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104004; rev:2;)
alert tcp $HOME_NET any -> 141.94.121.162 6673 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103828; rev:2;)
alert tcp $HOME_NET any -> 146.70.49.42 7080 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9105982; rev:2;)
alert tls $HOME_NET any -> 155.94.150.221 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9104448; rev:2;)
alert tls $HOME_NET any -> 155.94.163.75 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9103817; rev:2;)
alert tcp $HOME_NET any -> 156.238.120.12 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104080; rev:2;)
alert tcp $HOME_NET any -> 156.247.40.190 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101671; rev:2;)
alert tcp $HOME_NET any -> 156.247.40.190 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101670; rev:2;)
alert tcp $HOME_NET any -> 172.174.128.128 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101330; rev:2;)
alert tcp $HOME_NET any -> 173.249.197.20 9304 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104083; rev:2;)
alert tcp $HOME_NET any -> 181.206.158.190 1000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9105981; rev:2;)
alert tcp $HOME_NET any -> 185.213.25.37 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103816; rev:2;)
alert tcp $HOME_NET any -> 192.30.242.138 7000 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9103636; rev:2;)
alert tcp $HOME_NET any -> 193.32.162.160 8443 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9106190; rev:2;)
alert tcp $HOME_NET any -> 204.48.25.60 4449 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9104082; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.37 8848 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101669; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.37 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101668; rev:2;)
alert tcp $HOME_NET any -> 207.56.7.53 12159 (msg:"HOLLOWPOINT C2 dcrat"; reference:url,publicmosaic.com/indicators; sid:9101679; rev:2;)