# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 127 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family flying-eagle — https://publicmosaic.com/c2/flying-eagle
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 5.231.106.237 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f7caa9ecaea4b77affd68f5e1816d1ec2de8273974aa86cc4cae59ed3cfe3f3f"; reference:url,publicmosaic.com/indicators; sid:9105809; rev:2;)
alert tcp $HOME_NET any -> 8.146.235.16 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9106353; rev:2;)
alert tls $HOME_NET any -> 8.146.235.16 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4acfcac0fd14e7d5750ee15e9befbd4966f9fa4f078ec004a18502a33dfdad5e"; reference:url,publicmosaic.com/indicators; sid:9105121; rev:2;)
alert tls $HOME_NET any -> 27.124.43.141 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101845; rev:2;)
alert tls $HOME_NET any -> 27.124.43.145 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101848; rev:2;)
alert tls $HOME_NET any -> 27.124.43.241 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101844; rev:2;)
alert tls $HOME_NET any -> 34.21.159.88 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f7f306fba19b7cd7c482db8f3ef967876939741da4a59bfc3d0b0a6cd8d252a3"; reference:url,publicmosaic.com/indicators; sid:9101846; rev:2;)
alert tcp $HOME_NET any -> 36.255.97.86 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9105808; rev:2;)
alert tls $HOME_NET any -> 36.255.97.86 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"055b576a9afecc5ef42ad895363f7796a867d9aa07d794565166daeb6a4eff91"; reference:url,publicmosaic.com/indicators; sid:9103945; rev:2;)
alert tcp $HOME_NET any -> 38.22.95.126 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101849; rev:2;)
alert tls $HOME_NET any -> 38.60.250.235 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"5c2fc5ef5c9aef4902d732d4f5ee9568eb4cced4906bd099790927ea0a37a0ce"; reference:url,publicmosaic.com/indicators; sid:9101847; rev:2;)
alert tls $HOME_NET any -> 38.76.188.210 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1f052e8ae9bed6cad4cd9f452aa481c5f185bdf2e296f226edb3ba49a1e47bb6"; reference:url,publicmosaic.com/indicators; sid:9106828; rev:2;)
alert tls $HOME_NET any -> 38.76.216.18 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"bc8aea6bf2d0ec28542895e0e246abce41ca97e97898acf372c89f8be773684e"; reference:url,publicmosaic.com/indicators; sid:9101839; rev:2;)
alert tls $HOME_NET any -> 38.76.216.85 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"3aec3738c0a8dfe80f99fa0eae93367e39ccb22aa02233651a69b74f29921641"; reference:url,publicmosaic.com/indicators; sid:9101842; rev:2;)
alert tls $HOME_NET any -> 38.95.74.22 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"6c3ca45d8437b90d8fdfe9ee710903309511abceec6561d89ed5dbe470a65041"; reference:url,publicmosaic.com/indicators; sid:9106351; rev:2;)
alert tls $HOME_NET any -> 39.109.101.47 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9871bd61c91d98c19d5a3ff7eb3fe514237acca43595190d9186d4cccb0bc5d2"; reference:url,publicmosaic.com/indicators; sid:9106640; rev:2;)
alert tcp $HOME_NET any -> 43.198.96.27 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101843; rev:2;)
alert tls $HOME_NET any -> 45.192.167.143 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9105807; rev:2;)
alert tls $HOME_NET any -> 45.192.214.41 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"03c53006380da459c0a7108732a714f92eab9760f6eeb87f5ca0342b53a88e8c"; reference:url,publicmosaic.com/indicators; sid:9103921; rev:2;)
alert tls $HOME_NET any -> 45.192.226.12 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"03c53006380da459c0a7108732a714f92eab9760f6eeb87f5ca0342b53a88e8c"; reference:url,publicmosaic.com/indicators; sid:9103920; rev:2;)
alert tls $HOME_NET any -> 45.194.36.21 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"2a5b40814c306539f2b23c69ade7c4187f7ce6cb929080c64eeee3d7d3b94aa3"; reference:url,publicmosaic.com/indicators; sid:9101841; rev:2;)
alert tcp $HOME_NET any -> 47.95.178.192 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101840; rev:2;)
alert tls $HOME_NET any -> 47.95.178.192 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"521aca23854d1f356e1623115ade1df97ded7ac28f445ac931bc84a4be8cf00e"; reference:url,publicmosaic.com/indicators; sid:9101838; rev:2;)
alert tls $HOME_NET any -> 52.196.120.218 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4fcb683a3d983b21973d67dd5b76fb52298b393655f1fa1b0b90512b60d91933"; reference:url,publicmosaic.com/indicators; sid:9101836; rev:2;)
alert tcp $HOME_NET any -> 64.81.30.37 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101837; rev:2;)
alert tls $HOME_NET any -> 64.81.30.37 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9c1d8750541f143c2423aeec1918cafc6b8adee91dad285aafc9e2c50c131d5d"; reference:url,publicmosaic.com/indicators; sid:9101833; rev:2;)
alert tcp $HOME_NET any -> 64.90.11.106 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101835; rev:2;)
alert tls $HOME_NET any -> 64.90.27.50 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"ec3c2cad50ea9ff0e8fe8bf4293d287bf53f85fe6765372d9c31e9f57f774b17"; reference:url,publicmosaic.com/indicators; sid:9101834; rev:2;)
alert tls $HOME_NET any -> 64.90.30.189 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"249bf06f36c829e36615a9140e53e273c4af5994fcee668b73c71eb9830c6b8b"; reference:url,publicmosaic.com/indicators; sid:9101831; rev:2;)
alert tls $HOME_NET any -> 64.90.31.240 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"c399c9739fa8838cef44b879f3cc644e657509c215927a3862ed5f7c511624ac"; reference:url,publicmosaic.com/indicators; sid:9106639; rev:2;)
alert tls $HOME_NET any -> 78.13.51.110 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f5147b4a99e46203ca2ca410babd3332eaf73795dc80e249932eda3087e30453"; reference:url,publicmosaic.com/indicators; sid:9101832; rev:2;)
alert tcp $HOME_NET any -> 89.169.52.109 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101830; rev:2;)
alert tls $HOME_NET any -> 89.169.52.109 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"b01e545d715c22c4afce49cb590732d5a7d378481a994b5863c88ae837b806fd"; reference:url,publicmosaic.com/indicators; sid:9101829; rev:2;)
alert tls $HOME_NET any -> 96.126.179.22 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"bdf1574235613190f5a70244dfbf7ed0a83c4c7447287112d43611d6c5244473"; reference:url,publicmosaic.com/indicators; sid:9101828; rev:2;)
alert tls $HOME_NET any -> 103.40.113.250 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101827; rev:2;)
alert tls $HOME_NET any -> 103.40.113.251 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101824; rev:2;)
alert tls $HOME_NET any -> 103.40.113.253 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101821; rev:2;)
alert tls $HOME_NET any -> 103.40.113.254 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101822; rev:2;)
alert tls $HOME_NET any -> 103.52.152.203 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9b53fc9bc85367828503723fff9a87d6f19220be5b9e6f1f3f2704a86d1c85ff"; reference:url,publicmosaic.com/indicators; sid:9101826; rev:2;)
alert tls $HOME_NET any -> 103.112.99.63 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"5fb845ca643ee3650552ed8c4802bcb66401440d728fcfbe2d48746e48d1a35e"; reference:url,publicmosaic.com/indicators; sid:9103919; rev:2;)
alert tls $HOME_NET any -> 103.121.95.77 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4a1cdc7f75aa727393031adff86683518708963ab1b521bed3b35962ff7feef7"; reference:url,publicmosaic.com/indicators; sid:9106638; rev:2;)
alert tls $HOME_NET any -> 103.171.34.111 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"bd1f09c2816550ff17988997b18f4559e813f2b4b6d8ca64aeaddeab358a5f52"; reference:url,publicmosaic.com/indicators; sid:9101825; rev:2;)
alert tls $HOME_NET any -> 103.212.187.15 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9e6144255b8977d7b81d643b9d1b748fb2d16bd775ab7324a43a156e29a4352a"; reference:url,publicmosaic.com/indicators; sid:9106197; rev:2;)
alert tls $HOME_NET any -> 103.249.105.42 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4fb807860f93908780e1b8d6495ad0fbf4d5c8545aa2c61f1b96b065dbb050b0"; reference:url,publicmosaic.com/indicators; sid:9105806; rev:2;)
alert tls $HOME_NET any -> 103.249.105.43 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4fb807860f93908780e1b8d6495ad0fbf4d5c8545aa2c61f1b96b065dbb050b0"; reference:url,publicmosaic.com/indicators; sid:9101823; rev:2;)
alert tls $HOME_NET any -> 103.249.105.106 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d8a6eb2d94fa45f6a5e834eca5d8b99740900e15b305ac7e3217e8e48a4f8ea"; reference:url,publicmosaic.com/indicators; sid:9101820; rev:2;)
alert tls $HOME_NET any -> 103.249.105.107 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d8a6eb2d94fa45f6a5e834eca5d8b99740900e15b305ac7e3217e8e48a4f8ea"; reference:url,publicmosaic.com/indicators; sid:9101817; rev:2;)
alert tls $HOME_NET any -> 103.249.106.26 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d9dcacb564a88b56b91e25c19a6edff9b5986903146c0c984a1a1b0430faabed"; reference:url,publicmosaic.com/indicators; sid:9101819; rev:2;)
alert tls $HOME_NET any -> 103.249.106.27 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d9dcacb564a88b56b91e25c19a6edff9b5986903146c0c984a1a1b0430faabed"; reference:url,publicmosaic.com/indicators; sid:9101818; rev:2;)
alert tls $HOME_NET any -> 103.249.106.28 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d9dcacb564a88b56b91e25c19a6edff9b5986903146c0c984a1a1b0430faabed"; reference:url,publicmosaic.com/indicators; sid:9101816; rev:2;)
alert tls $HOME_NET any -> 104.234.172.64 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9450c6a816f56ef3f8c8d7abd1109d7c6ea42a63856740e049925cae4af29a83"; reference:url,publicmosaic.com/indicators; sid:9103918; rev:2;)
alert tcp $HOME_NET any -> 107.173.63.224 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101815; rev:2;)
alert tls $HOME_NET any -> 107.173.63.224 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f78b9d8ea35cd9b10d2406e31c2918b66c523a003d791dad14fca84e5912b4bd"; reference:url,publicmosaic.com/indicators; sid:9101814; rev:2;)
alert tls $HOME_NET any -> 108.165.147.100 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"b8882e2040379c3802b3bed7f512dce8f83bc5c018dcbd3757a04292dd488acc"; reference:url,publicmosaic.com/indicators; sid:9101813; rev:2;)
alert tls $HOME_NET any -> 108.165.255.26 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"691e25dab78c241a8b72bb3abdf9d20f18e249ea5b556dab82d40032bcda2389"; reference:url,publicmosaic.com/indicators; sid:9101812; rev:2;)
alert tls $HOME_NET any -> 108.187.1.190 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8bdce35a2bffa6a18276f136ac068a51789368c16e5f673df8f226cd60e9f138"; reference:url,publicmosaic.com/indicators; sid:9101811; rev:2;)
alert tls $HOME_NET any -> 108.187.7.167 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46bc95551968839d62a95e718d4c110d3940e6887dbb937b318d8658f9d9dfe6"; reference:url,publicmosaic.com/indicators; sid:9103917; rev:2;)
alert tls $HOME_NET any -> 108.187.43.87 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"eb92fbe1ff30fb3736725584d19cabab6a916bda11dee11c4d45ec6a415bbe78"; reference:url,publicmosaic.com/indicators; sid:9101809; rev:2;)
alert tls $HOME_NET any -> 108.187.43.157 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f959c52ab733ad98135512181b828bc490c58d9c3199f44c41c4e9b103de7ad3"; reference:url,publicmosaic.com/indicators; sid:9103916; rev:2;)
alert tls $HOME_NET any -> 112.121.166.90 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8d63fd0c8387b846788cacab21a41d85052fcb4680e06139bcaa7ead371237dd"; reference:url,publicmosaic.com/indicators; sid:9103924; rev:2;)
alert tls $HOME_NET any -> 112.121.166.92 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8d63fd0c8387b846788cacab21a41d85052fcb4680e06139bcaa7ead371237dd"; reference:url,publicmosaic.com/indicators; sid:9101810; rev:2;)
alert tcp $HOME_NET any -> 118.107.23.26 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101806; rev:2;)
alert tls $HOME_NET any -> 118.107.47.27 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"645a14f0c8333f5b0eb0bf2de85ecffc9801cb1ffa7f19beff727de192a943d4"; reference:url,publicmosaic.com/indicators; sid:9105805; rev:2;)
alert tls $HOME_NET any -> 118.107.47.28 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"645a14f0c8333f5b0eb0bf2de85ecffc9801cb1ffa7f19beff727de192a943d4"; reference:url,publicmosaic.com/indicators; sid:9105804; rev:2;)
alert tls $HOME_NET any -> 128.14.14.188 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d8a6eb2d94fa45f6a5e834eca5d8b99740900e15b305ac7e3217e8e48a4f8ea"; reference:url,publicmosaic.com/indicators; sid:9101808; rev:2;)
alert tls $HOME_NET any -> 143.92.32.198 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"abf64197d32d00d8d87116343843d53887d362b93330620683f5a1f8f3701681"; reference:url,publicmosaic.com/indicators; sid:9101805; rev:2;)
alert tls $HOME_NET any -> 143.92.36.171 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"711241c584fc4b66b18dc6334d61f47ca10068fe7280b4106c1df39232c480bc"; reference:url,publicmosaic.com/indicators; sid:9101799; rev:2;)
alert tls $HOME_NET any -> 143.92.36.176 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"711241c584fc4b66b18dc6334d61f47ca10068fe7280b4106c1df39232c480bc"; reference:url,publicmosaic.com/indicators; sid:9101807; rev:2;)
alert tcp $HOME_NET any -> 149.33.6.14 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101804; rev:2;)
alert tcp $HOME_NET any -> 149.33.6.14 8035 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101803; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.69 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101802; rev:2;)
alert tls $HOME_NET any -> 149.88.73.69 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"39c015d1a2922badbec4f3f7ab18487e70c3a854ca802bee8a44370f34f91940"; reference:url,publicmosaic.com/indicators; sid:9101801; rev:2;)
alert tls $HOME_NET any -> 149.88.73.101 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"c87098f9a4efa6e1ed2d39a8217c56ba0f661d4df7ac15811c21e0df444bf6aa"; reference:url,publicmosaic.com/indicators; sid:9101800; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.230 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101796; rev:2;)
alert tcp $HOME_NET any -> 149.88.73.236 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101797; rev:2;)
alert tls $HOME_NET any -> 154.12.83.111 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"50649097eff277ccf62b7bb06f7e442426436ab9dbd405d8060f71d70a9e30bb"; reference:url,publicmosaic.com/indicators; sid:9103915; rev:2;)
alert tcp $HOME_NET any -> 154.12.90.160 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101798; rev:2;)
alert tls $HOME_NET any -> 154.12.90.160 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"db17e1bfd02de4c089a66cd85a7dac5a42ad0e6d1a56744011b676185fc9d30c"; reference:url,publicmosaic.com/indicators; sid:9103914; rev:2;)
alert tls $HOME_NET any -> 154.201.68.199 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d06656f0b1ce1ab971bc949ad667e27ed0c3e458b242dcabd6f95566abbdb9e7"; reference:url,publicmosaic.com/indicators; sid:9101793; rev:2;)
alert tls $HOME_NET any -> 154.213.177.139 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dbc21df8f27373cf3e5549f350255c9357aa2309603e7daefd142c758c516386"; reference:url,publicmosaic.com/indicators; sid:9106637; rev:2;)
alert tls $HOME_NET any -> 154.213.177.154 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dbc21df8f27373cf3e5549f350255c9357aa2309603e7daefd142c758c516386"; reference:url,publicmosaic.com/indicators; sid:9101795; rev:2;)
alert tls $HOME_NET any -> 154.219.100.47 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"88c0221e897bf5e909c0f82e3a3d3f10de2756752c2473cae2fa6c8ff8f547dd"; reference:url,publicmosaic.com/indicators; sid:9101794; rev:2;)
alert tls $HOME_NET any -> 154.219.100.114 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"88c0221e897bf5e909c0f82e3a3d3f10de2756752c2473cae2fa6c8ff8f547dd"; reference:url,publicmosaic.com/indicators; sid:9101790; rev:2;)
alert tcp $HOME_NET any -> 154.222.16.221 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101788; rev:2;)
alert tls $HOME_NET any -> 156.225.18.58 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1f052e8ae9bed6cad4cd9f452aa481c5f185bdf2e296f226edb3ba49a1e47bb6"; reference:url,publicmosaic.com/indicators; sid:9101792; rev:2;)
alert tcp $HOME_NET any -> 156.225.25.25 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101789; rev:2;)
alert tls $HOME_NET any -> 156.225.26.254 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d569f174971960b7712ad42f5704e6cf5186a9c3b3689286f00766cadfd4058b"; reference:url,publicmosaic.com/indicators; sid:9101791; rev:2;)
alert tls $HOME_NET any -> 189.24.78.208 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8e8886b0680f31c5fc5f421a74f8d0e37c194a9ae1ba393b03c7647ce348b445"; reference:url,publicmosaic.com/indicators; sid:9106636; rev:2;)
alert tls $HOME_NET any -> 192.163.168.3 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"077f2790925065d4f7897c745a1f88615cdc9041e6ca3d26add8e5722c334129"; reference:url,publicmosaic.com/indicators; sid:9106635; rev:2;)
alert tls $HOME_NET any -> 192.163.168.6 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"077f2790925065d4f7897c745a1f88615cdc9041e6ca3d26add8e5722c334129"; reference:url,publicmosaic.com/indicators; sid:9101787; rev:2;)
alert tls $HOME_NET any -> 192.163.168.132 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"357e11630d507ee98e58a03bef8f8659ce7edbf3b27f61e428b6f9e1accaeefc"; reference:url,publicmosaic.com/indicators; sid:9106352; rev:2;)
alert tls $HOME_NET any -> 192.163.168.135 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"357e11630d507ee98e58a03bef8f8659ce7edbf3b27f61e428b6f9e1accaeefc"; reference:url,publicmosaic.com/indicators; sid:9101786; rev:2;)
alert tcp $HOME_NET any -> 192.163.169.147 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9106634; rev:2;)
alert tls $HOME_NET any -> 192.229.116.19 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a36361793251110db8513386b3658390e9b5d3f46aff5215a854a228512dc581"; reference:url,publicmosaic.com/indicators; sid:9101783; rev:2;)
alert tls $HOME_NET any -> 192.229.116.34 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a36361793251110db8513386b3658390e9b5d3f46aff5215a854a228512dc581"; reference:url,publicmosaic.com/indicators; sid:9101782; rev:2;)
alert tls $HOME_NET any -> 192.238.134.187 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9101785; rev:2;)
alert tls $HOME_NET any -> 192.238.134.190 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9103913; rev:2;)
alert tls $HOME_NET any -> 192.238.162.8 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d01900b7ac7ccbc9119e93501adaaa9540174034c6fb0db2ba51e00210ab7d1"; reference:url,publicmosaic.com/indicators; sid:9101781; rev:2;)
alert tls $HOME_NET any -> 192.238.162.10 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d01900b7ac7ccbc9119e93501adaaa9540174034c6fb0db2ba51e00210ab7d1"; reference:url,publicmosaic.com/indicators; sid:9101784; rev:2;)
alert tcp $HOME_NET any -> 192.252.178.206 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101780; rev:2;)
alert tls $HOME_NET any -> 192.252.178.206 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dd277d53eab335690cc92ad19c9408f937b8d36eda48e167ecee2b470e4c9452"; reference:url,publicmosaic.com/indicators; sid:9101779; rev:2;)
alert tcp $HOME_NET any -> 195.86.16.116 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101778; rev:2;)
alert tls $HOME_NET any -> 202.181.26.220 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"325f4da61419493254cd986f7c1707c886fe588da4d4df6a0865180b2b14b85a"; reference:url,publicmosaic.com/indicators; sid:9101777; rev:2;)
alert tcp $HOME_NET any -> 206.119.91.3 80 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101776; rev:2;)
alert tcp $HOME_NET any -> 206.119.91.3 8035 (msg:"HOLLOWPOINT C2 flying_eagle"; reference:url,publicmosaic.com/indicators; sid:9101775; rev:2;)
alert tls $HOME_NET any -> 207.56.28.76 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46d505ee1c7a48ee395088b37e4cbc09712cc076bbb1c82de8c0cbbb07adb018"; reference:url,publicmosaic.com/indicators; sid:9101774; rev:2;)
alert tls $HOME_NET any -> 207.56.28.84 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46d505ee1c7a48ee395088b37e4cbc09712cc076bbb1c82de8c0cbbb07adb018"; reference:url,publicmosaic.com/indicators; sid:9101773; rev:2;)
alert tls $HOME_NET any -> 207.56.28.189 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"949e6ca0bc33f8be4bcf5e01f0719ffe0f9f4ac227581f64912d5ae143a0d40b"; reference:url,publicmosaic.com/indicators; sid:9106633; rev:2;)
alert tls $HOME_NET any -> 207.56.28.225 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"949e6ca0bc33f8be4bcf5e01f0719ffe0f9f4ac227581f64912d5ae143a0d40b"; reference:url,publicmosaic.com/indicators; sid:9105803; rev:2;)
alert tls $HOME_NET any -> 207.56.30.198 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a5f1cd427b6e5db84de6a765e75eb11293fc5821a5a250dbb15cfd9d4b8fab05"; reference:url,publicmosaic.com/indicators; sid:9101771; rev:2;)
alert tls $HOME_NET any -> 207.56.30.219 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a5f1cd427b6e5db84de6a765e75eb11293fc5821a5a250dbb15cfd9d4b8fab05"; reference:url,publicmosaic.com/indicators; sid:9101769; rev:2;)
alert tls $HOME_NET any -> 207.56.119.21 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8302f74a483379cb2574c161e37b6593529d6010d82b3fd32141a0300bb5197c"; reference:url,publicmosaic.com/indicators; sid:9101770; rev:2;)
alert tls $HOME_NET any -> 207.56.119.35 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d798059ba575718e4b068de1c824fa2db24ff411ce58bbfb958a27321e7fa56b"; reference:url,publicmosaic.com/indicators; sid:9101772; rev:2;)
alert tls $HOME_NET any -> 207.56.119.48 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8412a1de75aad90b989069cd4d09fc97c5a8fb77194317cb427788bed05e8514"; reference:url,publicmosaic.com/indicators; sid:9101761; rev:2;)
alert tls $HOME_NET any -> 207.56.119.80 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"e0db6c08cfb26c614ac9ea7b3306949eb3db5c24f04e06a735aa8001e0a8f962"; reference:url,publicmosaic.com/indicators; sid:9101766; rev:2;)
alert tls $HOME_NET any -> 207.56.119.82 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d798059ba575718e4b068de1c824fa2db24ff411ce58bbfb958a27321e7fa56b"; reference:url,publicmosaic.com/indicators; sid:9101768; rev:2;)
alert tls $HOME_NET any -> 207.56.119.92 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1fd0b98e60895cd6e4207376960d21da27cf0433cef663d0204b74cfffdc1649"; reference:url,publicmosaic.com/indicators; sid:9101767; rev:2;)
alert tls $HOME_NET any -> 207.56.119.96 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"98da1e2d366061f244a05c636fe5620b5948b03cf10637cf977f76d52d14f688"; reference:url,publicmosaic.com/indicators; sid:9101759; rev:2;)
alert tls $HOME_NET any -> 207.56.119.123 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8302f74a483379cb2574c161e37b6593529d6010d82b3fd32141a0300bb5197c"; reference:url,publicmosaic.com/indicators; sid:9101760; rev:2;)
alert tls $HOME_NET any -> 207.56.119.139 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8412a1de75aad90b989069cd4d09fc97c5a8fb77194317cb427788bed05e8514"; reference:url,publicmosaic.com/indicators; sid:9101765; rev:2;)
alert tls $HOME_NET any -> 207.56.119.183 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7da07b37260b9396b553ab51baf46e9e3439227ac5570730c0afba36621808d8"; reference:url,publicmosaic.com/indicators; sid:9106350; rev:2;)
alert tls $HOME_NET any -> 207.56.119.194 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7da07b37260b9396b553ab51baf46e9e3439227ac5570730c0afba36621808d8"; reference:url,publicmosaic.com/indicators; sid:9101763; rev:2;)
alert tls $HOME_NET any -> 207.56.119.200 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"e0db6c08cfb26c614ac9ea7b3306949eb3db5c24f04e06a735aa8001e0a8f962"; reference:url,publicmosaic.com/indicators; sid:9101758; rev:2;)
alert tls $HOME_NET any -> 207.56.138.49 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"aceb945117e84094314066fca5ffcc779b30d13a477c5e3b75f610ce02e62116"; reference:url,publicmosaic.com/indicators; sid:9101762; rev:2;)
alert tls $HOME_NET any -> 207.56.138.80 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"359fd01dc83f1770c49176c861fce1e6a993f88c1b9f43e3214fadcb8e201f25"; reference:url,publicmosaic.com/indicators; sid:9106632; rev:2;)
alert tls $HOME_NET any -> 207.56.138.97 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"aceb945117e84094314066fca5ffcc779b30d13a477c5e3b75f610ce02e62116"; reference:url,publicmosaic.com/indicators; sid:9101764; rev:2;)
alert tls $HOME_NET any -> 207.56.138.140 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"359fd01dc83f1770c49176c861fce1e6a993f88c1b9f43e3214fadcb8e201f25"; reference:url,publicmosaic.com/indicators; sid:9101757; rev:2;)