# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 105 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family ligolo — https://publicmosaic.com/c2/ligolo
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 2.59.81.245 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103959; rev:2;)
alert tcp $HOME_NET any -> 3.96.173.64 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101616; rev:2;)
alert tcp $HOME_NET any -> 3.249.180.223 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104002; rev:2;)
alert tls $HOME_NET any -> 4.246.219.92 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"8f0b807d31abdc301112e7ec40ddeba57c5cb1cface080146d999aa2c12f876b"; reference:url,publicmosaic.com/indicators; sid:9101697; rev:2;)
alert tcp $HOME_NET any -> 5.188.118.251 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104506; rev:2;)
alert tls $HOME_NET any -> 8.221.103.101 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"a76ac0185fa8ce94ba6162d1f0b94b027ea571a31652609e963a0a40a588f2ea"; reference:url,publicmosaic.com/indicators; sid:9101700; rev:2;)
alert tls $HOME_NET any -> 15.237.123.87 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0e2b20a9ba0c02f023445286996b1920d88dff77e85769d1adb3d097d54d8c5f"; reference:url,publicmosaic.com/indicators; sid:9101698; rev:2;)
alert tcp $HOME_NET any -> 18.117.245.182 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106733; rev:2;)
alert tls $HOME_NET any -> 20.115.112.185 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"3d0147473d7c167021f749fb47b37cece531a30885bea177e395ff7938b86026"; reference:url,publicmosaic.com/indicators; sid:9101696; rev:2;)
alert tcp $HOME_NET any -> 20.115.112.186 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104052; rev:2;)
alert tcp $HOME_NET any -> 20.121.198.242 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104505; rev:2;)
alert tcp $HOME_NET any -> 20.127.87.129 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105647; rev:2;)
alert tls $HOME_NET any -> 20.206.67.182 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"b50f8fa45462a3fa82c325b9d1adf957eb5fd8b8b9f703b8924341e9c05507be"; reference:url,publicmosaic.com/indicators; sid:9101695; rev:2;)
alert tls $HOME_NET any -> 20.206.67.182 2083 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"b50f8fa45462a3fa82c325b9d1adf957eb5fd8b8b9f703b8924341e9c05507be"; reference:url,publicmosaic.com/indicators; sid:9101694; rev:2;)
alert tcp $HOME_NET any -> 31.56.197.231 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101615; rev:2;)
alert tcp $HOME_NET any -> 31.56.229.231 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106206; rev:2;)
alert tcp $HOME_NET any -> 34.14.122.215 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106086; rev:2;)
alert tcp $HOME_NET any -> 34.19.22.113 8081 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104453; rev:2;)
alert tcp $HOME_NET any -> 34.19.22.113 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103330; rev:2;)
alert tcp $HOME_NET any -> 38.80.148.157 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103329; rev:2;)
alert tcp $HOME_NET any -> 43.212.255.197 2096 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106161; rev:2;)
alert tcp $HOME_NET any -> 44.255.175.80 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104504; rev:2;)
alert tcp $HOME_NET any -> 45.76.154.192 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103328; rev:2;)
alert tcp $HOME_NET any -> 45.77.64.118 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106008; rev:2;)
alert tcp $HOME_NET any -> 45.158.196.75 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105802; rev:2;)
alert tcp $HOME_NET any -> 45.158.196.75 11604 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105130; rev:2;)
alert tcp $HOME_NET any -> 45.227.254.45 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101614; rev:2;)
alert tcp $HOME_NET any -> 46.151.182.182 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103958; rev:2;)
alert tls $HOME_NET any -> 47.89.175.103 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"8681653c2987fc4f66efd1c9460465f8646b838839b6ca4e7b4057ce9ba7787c"; reference:url,publicmosaic.com/indicators; sid:9101693; rev:2;)
alert tcp $HOME_NET any -> 51.124.247.149 139 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101613; rev:2;)
alert tcp $HOME_NET any -> 62.171.163.207 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103327; rev:2;)
alert tcp $HOME_NET any -> 64.111.92.7 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104503; rev:2;)
alert tcp $HOME_NET any -> 67.207.81.22 5433 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103326; rev:2;)
alert tcp $HOME_NET any -> 69.48.228.204 9091 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101612; rev:2;)
alert tls $HOME_NET any -> 77.232.43.48 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"d434f02322d04a8f92308b231f56b1b8f566f4407515c1455503fa4a6b80aa52"; reference:url,publicmosaic.com/indicators; sid:9101692; rev:2;)
alert tcp $HOME_NET any -> 77.237.240.107 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101611; rev:2;)
alert tcp $HOME_NET any -> 78.17.212.195 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104502; rev:2;)
alert tcp $HOME_NET any -> 78.31.250.69 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101610; rev:2;)
alert tcp $HOME_NET any -> 80.251.213.212 9443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103325; rev:2;)
alert tcp $HOME_NET any -> 83.136.250.175 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104112; rev:2;)
alert tcp $HOME_NET any -> 83.217.215.197 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104834; rev:2;)
alert tcp $HOME_NET any -> 84.247.132.220 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103324; rev:2;)
alert tcp $HOME_NET any -> 84.247.166.79 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103323; rev:2;)
alert tcp $HOME_NET any -> 84.247.182.55 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101608; rev:2;)
alert tcp $HOME_NET any -> 85.9.198.7 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103322; rev:2;)
alert tcp $HOME_NET any -> 87.58.154.224 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103321; rev:2;)
alert tcp $HOME_NET any -> 89.116.31.27 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103783; rev:2;)
alert tcp $HOME_NET any -> 89.125.48.185 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104111; rev:2;)
alert tcp $HOME_NET any -> 89.127.232.201 12123 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101607; rev:2;)
alert tcp $HOME_NET any -> 89.150.40.155 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106439; rev:2;)
alert tcp $HOME_NET any -> 94.101.178.199 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103320; rev:2;)
alert tcp $HOME_NET any -> 103.183.47.154 9001 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103319; rev:2;)
alert tls $HOME_NET any -> 104.171.138.204 80 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"6668ad29f81e61c3779bb847c3443ec17bf2d41aec2add7baa69ca8faa1b95db"; reference:url,publicmosaic.com/indicators; sid:9101691; rev:2;)
alert tls $HOME_NET any -> 104.207.73.57 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0792204c7e078c3215b8fb64b9b7c8a01bf7f2fcef27c6f42d0e28c1b332d762"; reference:url,publicmosaic.com/indicators; sid:9105021; rev:2;)
alert tls $HOME_NET any -> 104.211.21.237 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0cb6f12e4024ce87f9a4feebb36b67782e8fb9bb2e352498b63a3e3ab2d62fbe"; reference:url,publicmosaic.com/indicators; sid:9101690; rev:2;)
alert tcp $HOME_NET any -> 129.80.218.92 993 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101606; rev:2;)
alert tcp $HOME_NET any -> 129.80.218.92 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101605; rev:2;)
alert tcp $HOME_NET any -> 130.94.17.70 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103317; rev:2;)
alert tcp $HOME_NET any -> 135.220.199.165 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103316; rev:2;)
alert tcp $HOME_NET any -> 137.74.171.99 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105286; rev:2;)
alert tcp $HOME_NET any -> 137.184.197.155 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101604; rev:2;)
alert tcp $HOME_NET any -> 138.2.99.199 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103315; rev:2;)
alert tcp $HOME_NET any -> 143.110.180.148 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106732; rev:2;)
alert tcp $HOME_NET any -> 143.246.217.59 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101603; rev:2;)
alert tcp $HOME_NET any -> 146.59.153.194 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104501; rev:2;)
alert tcp $HOME_NET any -> 146.190.154.156 80 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103314; rev:2;)
alert tcp $HOME_NET any -> 147.93.188.97 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103313; rev:2;)
alert tcp $HOME_NET any -> 148.113.58.127 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103312; rev:2;)
alert tcp $HOME_NET any -> 148.113.59.45 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103311; rev:2;)
alert tcp $HOME_NET any -> 148.113.59.191 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104000; rev:2;)
alert tcp $HOME_NET any -> 149.104.87.217 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101602; rev:2;)
alert tcp $HOME_NET any -> 157.230.80.211 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103310; rev:2;)
alert tcp $HOME_NET any -> 160.187.199.133 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103309; rev:2;)
alert tls $HOME_NET any -> 160.187.199.134 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9101689; rev:2;)
alert tls $HOME_NET any -> 160.187.199.160 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9104500; rev:2;)
alert tls $HOME_NET any -> 160.187.199.189 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9103865; rev:2;)
alert tls $HOME_NET any -> 160.187.199.189 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9101688; rev:2;)
alert tls $HOME_NET any -> 160.187.199.190 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9103866; rev:2;)
alert tcp $HOME_NET any -> 170.64.138.247 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103617; rev:2;)
alert tcp $HOME_NET any -> 172.2.234.2 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101601; rev:2;)
alert tls $HOME_NET any -> 172.174.29.141 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"d66ca9ff5dff583d9fe49230b7a29e835e5b5981cb4d7fa232fd5c213de43c2c"; reference:url,publicmosaic.com/indicators; sid:9101687; rev:2;)
alert tcp $HOME_NET any -> 177.124.72.24 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104499; rev:2;)
alert tcp $HOME_NET any -> 178.104.160.172 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101600; rev:2;)
alert tcp $HOME_NET any -> 181.223.11.202 4662 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105921; rev:2;)
alert tcp $HOME_NET any -> 185.14.92.143 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104110; rev:2;)
alert tcp $HOME_NET any -> 185.93.89.67 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106562; rev:2;)
alert tcp $HOME_NET any -> 185.193.66.120 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103308; rev:2;)
alert tcp $HOME_NET any -> 185.241.208.242 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103999; rev:2;)
alert tls $HOME_NET any -> 193.37.213.238 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0506430b3fcd911acd89ac0a747b8c60f78d4c1852ea57c1620e30a2bebfa3a8"; reference:url,publicmosaic.com/indicators; sid:9103864; rev:2;)
alert tcp $HOME_NET any -> 193.70.100.109 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101599; rev:2;)
alert tcp $HOME_NET any -> 194.59.31.172 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104109; rev:2;)
alert tcp $HOME_NET any -> 194.233.79.66 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103606; rev:2;)
alert tcp $HOME_NET any -> 195.16.44.77 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103307; rev:2;)
alert tcp $HOME_NET any -> 195.54.161.239 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101596; rev:2;)
alert tcp $HOME_NET any -> 199.192.25.43 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106085; rev:2;)
alert tcp $HOME_NET any -> 199.192.25.43 5453 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103998; rev:2;)
alert tcp $HOME_NET any -> 205.234.170.195 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101597; rev:2;)
alert tcp $HOME_NET any -> 209.94.58.109 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104108; rev:2;)
alert tcp $HOME_NET any -> 209.99.191.13 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9105701; rev:2;)
alert tcp $HOME_NET any -> 209.151.150.140 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9106731; rev:2;)
alert tcp $HOME_NET any -> 213.163.202.238 443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9104452; rev:2;)
alert tcp $HOME_NET any -> 217.6.46.91 8080 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101684; rev:2;)
alert tcp $HOME_NET any -> 217.6.46.91 8443 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9101685; rev:2;)
alert tls $HOME_NET any -> 217.6.46.91 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"3a80505f69983a72b47f444245a43899bd49e00aa09733b1e717d994d5b6fbb1"; reference:url,publicmosaic.com/indicators; sid:9101686; rev:2;)
alert tcp $HOME_NET any -> 217.216.73.36 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; reference:url,publicmosaic.com/indicators; sid:9103306; rev:2;)