# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 1010 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family mozi — https://publicmosaic.com/c2/mozi
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 19
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.61.151.195 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105295; rev:2;)
alert tcp $HOME_NET any -> 1.61.202.234 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101880; rev:2;)
alert tcp $HOME_NET any -> 2.181.242.160 36347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106721; rev:2;)
alert tcp $HOME_NET any -> 2.187.37.23 58603 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105208; rev:2;)
alert tcp $HOME_NET any -> 2.187.98.47 58030 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105411; rev:2;)
alert tcp $HOME_NET any -> 2.187.250.85 47417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106720; rev:2;)
alert tcp $HOME_NET any -> 2.187.250.85 59592 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105065; rev:2;)
alert tcp $HOME_NET any -> 5.56.8.40 60173 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105459; rev:2;)
alert tcp $HOME_NET any -> 5.134.254.0 37127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105655; rev:2;)
alert tcp $HOME_NET any -> 14.157.16.203 56002 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105285; rev:2;)
alert tcp $HOME_NET any -> 24.95.54.96 47647 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105772; rev:2;)
alert tcp $HOME_NET any -> 27.12.220.94 58619 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106769; rev:2;)
alert tcp $HOME_NET any -> 27.152.10.10 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103411; rev:2;)
alert tcp $HOME_NET any -> 27.153.152.10 40052 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103746; rev:2;)
alert tcp $HOME_NET any -> 27.202.53.216 45165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105771; rev:2;)
alert tcp $HOME_NET any -> 27.202.237.134 46617 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104988; rev:2;)
alert tcp $HOME_NET any -> 27.203.158.156 60406 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103745; rev:2;)
alert tcp $HOME_NET any -> 27.204.196.164 40053 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106768; rev:2;)
alert tcp $HOME_NET any -> 27.207.41.43 54515 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106370; rev:2;)
alert tcp $HOME_NET any -> 27.207.224.176 37565 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105382; rev:2;)
alert tcp $HOME_NET any -> 27.207.246.232 59924 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104744; rev:2;)
alert tcp $HOME_NET any -> 27.210.37.1 42263 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104921; rev:2;)
alert tcp $HOME_NET any -> 27.210.249.141 42418 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104734; rev:2;)
alert tcp $HOME_NET any -> 27.215.49.38 36855 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104748; rev:2;)
alert tcp $HOME_NET any -> 27.215.80.81 58529 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106719; rev:2;)
alert tcp $HOME_NET any -> 27.215.80.198 58347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104742; rev:2;)
alert tcp $HOME_NET any -> 27.215.84.127 37282 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105433; rev:2;)
alert tcp $HOME_NET any -> 27.215.85.29 36550 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104743; rev:2;)
alert tcp $HOME_NET any -> 27.215.124.53 58552 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106121; rev:2;)
alert tcp $HOME_NET any -> 27.215.138.54 34340 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106767; rev:2;)
alert tcp $HOME_NET any -> 27.215.210.140 47517 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105464; rev:2;)
alert tcp $HOME_NET any -> 27.215.210.163 49181 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105740; rev:2;)
alert tcp $HOME_NET any -> 27.215.212.148 34367 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106369; rev:2;)
alert tcp $HOME_NET any -> 27.218.236.119 47733 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101879; rev:2;)
alert tcp $HOME_NET any -> 27.219.50.172 60907 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106545; rev:2;)
alert tcp $HOME_NET any -> 27.220.86.44 46545 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105102; rev:2;)
alert tcp $HOME_NET any -> 27.222.48.192 43573 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103744; rev:2;)
alert tcp $HOME_NET any -> 27.222.89.207 48083 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103743; rev:2;)
alert tcp $HOME_NET any -> 27.222.243.52 39549 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106279; rev:2;)
alert tcp $HOME_NET any -> 31.129.0.57 56485 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103742; rev:2;)
alert tcp $HOME_NET any -> 36.64.184.26 46567 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104920; rev:2;)
alert tcp $HOME_NET any -> 36.64.184.26 51647 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106143; rev:2;)
alert tcp $HOME_NET any -> 36.68.93.208 57750 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106278; rev:2;)
alert tcp $HOME_NET any -> 36.69.76.83 47847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105846; rev:2;)
alert tcp $HOME_NET any -> 36.70.111.17 52592 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106386; rev:2;)
alert tcp $HOME_NET any -> 36.71.24.86 38254 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105064; rev:2;)
alert tcp $HOME_NET any -> 36.71.26.92 52208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105284; rev:2;)
alert tcp $HOME_NET any -> 36.77.230.229 47127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106004; rev:2;)
alert tcp $HOME_NET any -> 36.88.136.194 53727 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106544; rev:2;)
alert tcp $HOME_NET any -> 36.89.252.178 36257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106142; rev:2;)
alert tcp $HOME_NET any -> 37.52.132.186 43314 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105723; rev:2;)
alert tcp $HOME_NET any -> 37.78.38.173 50492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105283; rev:2;)
alert tcp $HOME_NET any -> 38.58.200.25 40355 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106277; rev:2;)
alert tcp $HOME_NET any -> 38.75.202.173 44405 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106385; rev:2;)
alert tcp $HOME_NET any -> 38.137.249.60 44817 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106141; rev:2;)
alert tcp $HOME_NET any -> 38.196.84.42 40091 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104951; rev:2;)
alert tcp $HOME_NET any -> 39.36.29.206 39940 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106556; rev:2;)
alert tcp $HOME_NET any -> 39.40.158.41 50979 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106276; rev:2;)
alert tcp $HOME_NET any -> 39.40.177.101 58273 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105700; rev:2;)
alert tcp $HOME_NET any -> 39.65.159.18 49124 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104892; rev:2;)
alert tcp $HOME_NET any -> 39.65.202.109 51237 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101878; rev:2;)
alert tcp $HOME_NET any -> 39.73.206.50 49985 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105770; rev:2;)
alert tcp $HOME_NET any -> 39.74.18.45 57987 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105722; rev:2;)
alert tcp $HOME_NET any -> 39.74.26.209 38746 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104741; rev:2;)
alert tcp $HOME_NET any -> 39.74.62.241 41341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105047; rev:2;)
alert tcp $HOME_NET any -> 39.74.114.50 59017 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104732; rev:2;)
alert tcp $HOME_NET any -> 39.79.47.37 48491 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105721; rev:2;)
alert tcp $HOME_NET any -> 39.79.68.65 34070 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106718; rev:2;)
alert tcp $HOME_NET any -> 39.80.60.21 60792 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103741; rev:2;)
alert tcp $HOME_NET any -> 39.81.37.15 40232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104739; rev:2;)
alert tcp $HOME_NET any -> 39.84.95.142 46029 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101877; rev:2;)
alert tcp $HOME_NET any -> 39.86.115.129 43919 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105444; rev:2;)
alert tcp $HOME_NET any -> 39.86.247.62 38819 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105387; rev:2;)
alert tcp $HOME_NET any -> 39.87.50.123 44919 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105422; rev:2;)
alert tcp $HOME_NET any -> 39.87.255.120 55663 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106275; rev:2;)
alert tcp $HOME_NET any -> 39.88.200.53 34933 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103740; rev:2;)
alert tcp $HOME_NET any -> 39.90.144.82 53918 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104740; rev:2;)
alert tcp $HOME_NET any -> 39.90.147.246 58169 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106384; rev:2;)
alert tcp $HOME_NET any -> 41.201.226.25 40320 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105442; rev:2;)
alert tcp $HOME_NET any -> 42.52.38.254 43443 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105384; rev:2;)
alert tcp $HOME_NET any -> 42.177.122.244 34345 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103860; rev:2;)
alert tcp $HOME_NET any -> 42.224.1.7 46113 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106543; rev:2;)
alert tcp $HOME_NET any -> 42.224.4.46 45846 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105458; rev:2;)
alert tcp $HOME_NET any -> 42.224.7.191 56165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105415; rev:2;)
alert tcp $HOME_NET any -> 42.224.64.165 33674 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105642; rev:2;)
alert tcp $HOME_NET any -> 42.224.64.204 53853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105608; rev:2;)
alert tcp $HOME_NET any -> 42.224.78.23 39508 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105410; rev:2;)
alert tcp $HOME_NET any -> 42.224.115.189 57237 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105457; rev:2;)
alert tcp $HOME_NET any -> 42.224.122.31 35568 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106274; rev:2;)
alert tcp $HOME_NET any -> 42.224.126.183 55514 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105273; rev:2;)
alert tcp $HOME_NET any -> 42.224.127.212 35568 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106542; rev:2;)
alert tcp $HOME_NET any -> 42.224.157.20 39780 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105272; rev:2;)
alert tcp $HOME_NET any -> 42.224.174.102 33440 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105416; rev:2;)
alert tcp $HOME_NET any -> 42.224.175.96 36970 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104738; rev:2;)
alert tcp $HOME_NET any -> 42.224.192.6 34023 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106716; rev:2;)
alert tcp $HOME_NET any -> 42.224.194.230 51692 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105046; rev:2;)
alert tcp $HOME_NET any -> 42.225.230.127 58769 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105845; rev:2;)
alert tcp $HOME_NET any -> 42.226.67.57 56542 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106120; rev:2;)
alert tcp $HOME_NET any -> 42.226.68.209 53631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105385; rev:2;)
alert tcp $HOME_NET any -> 42.226.79.45 41444 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105455; rev:2;)
alert tcp $HOME_NET any -> 42.227.1.51 47075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104736; rev:2;)
alert tcp $HOME_NET any -> 42.227.176.7 32988 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105270; rev:2;)
alert tcp $HOME_NET any -> 42.227.179.13 32824 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105409; rev:2;)
alert tcp $HOME_NET any -> 42.227.202.88 43796 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106541; rev:2;)
alert tcp $HOME_NET any -> 42.227.202.111 40117 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106367; rev:2;)
alert tcp $HOME_NET any -> 42.227.237.197 49632 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105348; rev:2;)
alert tcp $HOME_NET any -> 42.228.36.55 54911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105365; rev:2;)
alert tcp $HOME_NET any -> 42.228.124.66 38416 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105720; rev:2;)
alert tcp $HOME_NET any -> 42.228.216.218 55889 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104919; rev:2;)
alert tcp $HOME_NET any -> 42.228.236.172 34448 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106717; rev:2;)
alert tcp $HOME_NET any -> 42.228.239.154 34448 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105769; rev:2;)
alert tcp $HOME_NET any -> 42.228.245.61 34804 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106540; rev:2;)
alert tcp $HOME_NET any -> 42.229.190.158 59176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106366; rev:2;)
alert tcp $HOME_NET any -> 42.230.16.17 49033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105275; rev:2;)
alert tcp $HOME_NET any -> 42.230.55.38 54485 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106119; rev:2;)
alert tcp $HOME_NET any -> 42.231.70.134 33566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105739; rev:2;)
alert tcp $HOME_NET any -> 42.231.89.50 46000 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105768; rev:2;)
alert tcp $HOME_NET any -> 42.231.95.183 39082 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105767; rev:2;)
alert tcp $HOME_NET any -> 42.231.187.189 38441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106118; rev:2;)
alert tcp $HOME_NET any -> 42.231.202.85 57946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105463; rev:2;)
alert tcp $HOME_NET any -> 42.232.31.129 36569 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105274; rev:2;)
alert tcp $HOME_NET any -> 42.232.90.35 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105394; rev:2;)
alert tcp $HOME_NET any -> 42.232.225.98 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106156; rev:2;)
alert tcp $HOME_NET any -> 42.232.226.134 43284 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106539; rev:2;)
alert tcp $HOME_NET any -> 42.232.228.172 53412 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106273; rev:2;)
alert tcp $HOME_NET any -> 42.232.229.148 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105420; rev:2;)
alert tcp $HOME_NET any -> 42.233.91.171 56278 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105719; rev:2;)
alert tcp $HOME_NET any -> 42.233.106.146 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104725; rev:2;)
alert tcp $HOME_NET any -> 42.233.107.113 43544 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105432; rev:2;)
alert tcp $HOME_NET any -> 42.233.210.159 59519 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101876; rev:2;)
alert tcp $HOME_NET any -> 42.234.119.117 33571 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105718; rev:2;)
alert tcp $HOME_NET any -> 42.234.144.74 54788 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106538; rev:2;)
alert tcp $HOME_NET any -> 42.234.208.5 59424 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105381; rev:2;)
alert tcp $HOME_NET any -> 42.234.232.151 35677 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106537; rev:2;)
alert tcp $HOME_NET any -> 42.234.245.29 44847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106536; rev:2;)
alert tcp $HOME_NET any -> 42.234.246.38 55546 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105280; rev:2;)
alert tcp $HOME_NET any -> 42.235.36.83 54414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106535; rev:2;)
alert tcp $HOME_NET any -> 42.235.43.128 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106534; rev:2;)
alert tcp $HOME_NET any -> 42.235.48.143 51176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105045; rev:2;)
alert tcp $HOME_NET any -> 42.238.143.158 39299 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105467; rev:2;)
alert tcp $HOME_NET any -> 42.238.241.81 47417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106272; rev:2;)
alert tcp $HOME_NET any -> 42.238.242.50 35595 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105843; rev:2;)
alert tcp $HOME_NET any -> 42.239.143.201 52770 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105279; rev:2;)
alert tcp $HOME_NET any -> 42.239.150.66 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105766; rev:2;)
alert tcp $HOME_NET any -> 42.239.189.113 49093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106117; rev:2;)
alert tcp $HOME_NET any -> 42.239.225.72 37495 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105844; rev:2;)
alert tcp $HOME_NET any -> 42.239.230.18 57135 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106533; rev:2;)
alert tcp $HOME_NET any -> 42.243.252.236 59708 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106532; rev:2;)
alert tcp $HOME_NET any -> 43.245.39.42 53867 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104735; rev:2;)
alert tcp $HOME_NET any -> 43.245.39.47 46768 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104891; rev:2;)
alert tcp $HOME_NET any -> 43.245.39.127 54225 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104737; rev:2;)
alert tcp $HOME_NET any -> 43.252.159.76 37873 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105012; rev:2;)
alert tcp $HOME_NET any -> 43.252.159.78 60961 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104731; rev:2;)
alert tcp $HOME_NET any -> 43.252.159.117 39585 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104733; rev:2;)
alert tcp $HOME_NET any -> 45.165.172.92 51435 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106531; rev:2;)
alert tcp $HOME_NET any -> 45.171.177.193 36258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103859; rev:2;)
alert tcp $HOME_NET any -> 45.172.218.181 46033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106116; rev:2;)
alert tcp $HOME_NET any -> 45.172.218.181 57007 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104141; rev:2;)
alert tcp $HOME_NET any -> 45.177.32.104 36577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104280; rev:2;)
alert tcp $HOME_NET any -> 45.177.33.169 55300 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101875; rev:2;)
alert tcp $HOME_NET any -> 45.186.77.55 34939 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103739; rev:2;)
alert tcp $HOME_NET any -> 45.194.25.221 48483 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105765; rev:2;)
alert tcp $HOME_NET any -> 45.233.94.135 34363 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103738; rev:2;)
alert tcp $HOME_NET any -> 46.158.168.35 50492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101874; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.23 41753 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105354; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.106 52182 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104730; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.141 33052 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104729; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.142 41753 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104728; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.145 59574 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106530; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.160 41635 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105462; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.163 51558 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105461; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.230 33052 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105425; rev:2;)
alert tcp $HOME_NET any -> 47.22.166.163 56510 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101873; rev:2;)
alert tcp $HOME_NET any -> 47.208.139.29 48393 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103753; rev:2;)
alert tcp $HOME_NET any -> 47.212.193.38 44155 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103752; rev:2;)
alert tcp $HOME_NET any -> 47.215.224.64 41098 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104727; rev:2;)
alert tcp $HOME_NET any -> 58.22.18.152 33899 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103751; rev:2;)
alert tcp $HOME_NET any -> 58.22.210.127 46509 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106271; rev:2;)
alert tcp $HOME_NET any -> 58.37.101.152 39822 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103750; rev:2;)
alert tcp $HOME_NET any -> 59.96.136.164 52219 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105607; rev:2;)
alert tcp $HOME_NET any -> 59.101.211.141 51232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104726; rev:2;)
alert tcp $HOME_NET any -> 59.180.137.90 54794 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106555; rev:2;)
alert tcp $HOME_NET any -> 59.180.138.173 54794 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106270; rev:2;)
alert tcp $HOME_NET any -> 59.180.140.174 35156 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105113; rev:2;)
alert tcp $HOME_NET any -> 59.180.158.76 54794 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105282; rev:2;)
alert tcp $HOME_NET any -> 59.180.159.200 41778 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106158; rev:2;)
alert tcp $HOME_NET any -> 59.180.174.11 43407 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106436; rev:2;)
alert tcp $HOME_NET any -> 60.6.62.96 59328 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106269; rev:2;)
alert tcp $HOME_NET any -> 60.160.2.40 34828 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105427; rev:2;)
alert tcp $HOME_NET any -> 60.184.107.9 37858 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105606; rev:2;)
alert tcp $HOME_NET any -> 60.184.138.242 45870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105281; rev:2;)
alert tcp $HOME_NET any -> 60.211.59.115 55744 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106365; rev:2;)
alert tcp $HOME_NET any -> 60.215.197.174 38401 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101892; rev:2;)
alert tcp $HOME_NET any -> 60.216.131.62 43868 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101872; rev:2;)
alert tcp $HOME_NET any -> 61.52.3.67 41031 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106765; rev:2;)
alert tcp $HOME_NET any -> 61.52.33.22 43684 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106115; rev:2;)
alert tcp $HOME_NET any -> 61.52.34.120 58546 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106157; rev:2;)
alert tcp $HOME_NET any -> 61.52.37.73 50491 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105764; rev:2;)
alert tcp $HOME_NET any -> 61.52.55.252 40232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105044; rev:2;)
alert tcp $HOME_NET any -> 61.52.85.150 33059 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106268; rev:2;)
alert tcp $HOME_NET any -> 61.52.147.59 42873 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104918; rev:2;)
alert tcp $HOME_NET any -> 61.52.179.224 50718 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105605; rev:2;)
alert tcp $HOME_NET any -> 61.52.198.150 40687 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106267; rev:2;)
alert tcp $HOME_NET any -> 61.53.75.162 37419 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106715; rev:2;)
alert tcp $HOME_NET any -> 61.53.83.19 36154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105353; rev:2;)
alert tcp $HOME_NET any -> 61.53.87.97 37876 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106777; rev:2;)
alert tcp $HOME_NET any -> 61.53.90.140 41918 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105276; rev:2;)
alert tcp $HOME_NET any -> 61.53.91.238 55186 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105043; rev:2;)
alert tcp $HOME_NET any -> 61.53.95.155 37419 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105112; rev:2;)
alert tcp $HOME_NET any -> 61.53.103.200 46732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105278; rev:2;)
alert tcp $HOME_NET any -> 61.53.106.120 38038 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106529; rev:2;)
alert tcp $HOME_NET any -> 61.53.120.105 45884 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105453; rev:2;)
alert tcp $HOME_NET any -> 61.53.122.56 42123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105443; rev:2;)
alert tcp $HOME_NET any -> 61.53.150.15 38010 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105271; rev:2;)
alert tcp $HOME_NET any -> 61.53.151.142 41245 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105408; rev:2;)
alert tcp $HOME_NET any -> 61.53.152.228 38010 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106383; rev:2;)
alert tcp $HOME_NET any -> 61.53.236.32 49022 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106140; rev:2;)
alert tcp $HOME_NET any -> 61.54.167.178 52114 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105717; rev:2;)
alert tcp $HOME_NET any -> 61.54.233.14 52028 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105207; rev:2;)
alert tcp $HOME_NET any -> 61.144.101.122 55558 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105042; rev:2;)
alert tcp $HOME_NET any -> 61.216.49.127 49370 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104143; rev:2;)
alert tcp $HOME_NET any -> 66.8.135.142 58566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104724; rev:2;)
alert tcp $HOME_NET any -> 66.212.173.225 55933 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106714; rev:2;)
alert tcp $HOME_NET any -> 66.212.187.214 45901 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106286; rev:2;)
alert tcp $HOME_NET any -> 69.173.180.110 39821 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104140; rev:2;)
alert tcp $HOME_NET any -> 70.166.118.40 37408 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104723; rev:2;)
alert tcp $HOME_NET any -> 72.29.46.195 43633 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104722; rev:2;)
alert tcp $HOME_NET any -> 72.173.80.89 60191 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105424; rev:2;)
alert tcp $HOME_NET any -> 72.255.48.104 54566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105842; rev:2;)
alert tcp $HOME_NET any -> 77.53.43.110 47947 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105392; rev:2;)
alert tcp $HOME_NET any -> 77.247.88.88 46996 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103749; rev:2;)
alert tcp $HOME_NET any -> 78.38.16.176 54968 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104721; rev:2;)
alert tcp $HOME_NET any -> 78.38.18.127 44214 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104720; rev:2;)
alert tcp $HOME_NET any -> 78.38.18.210 38372 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106713; rev:2;)
alert tcp $HOME_NET any -> 78.38.19.88 33374 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106266; rev:2;)
alert tcp $HOME_NET any -> 78.38.19.161 52470 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106528; rev:2;)
alert tcp $HOME_NET any -> 78.187.104.169 56759 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106712; rev:2;)
alert tcp $HOME_NET any -> 81.227.54.149 33012 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104718; rev:2;)
alert tcp $HOME_NET any -> 81.230.148.181 51631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103748; rev:2;)
alert tcp $HOME_NET any -> 81.236.234.16 59159 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104717; rev:2;)
alert tcp $HOME_NET any -> 82.114.181.233 33360 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104716; rev:2;)
alert tcp $HOME_NET any -> 82.144.86.37 47425 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106776; rev:2;)
alert tcp $HOME_NET any -> 82.144.86.37 56329 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104950; rev:2;)
alert tcp $HOME_NET any -> 83.68.249.16 45432 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104714; rev:2;)
alert tcp $HOME_NET any -> 83.219.1.198 33918 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104715; rev:2;)
alert tcp $HOME_NET any -> 85.15.86.45 54363 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106364; rev:2;)
alert tcp $HOME_NET any -> 85.97.202.210 47390 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104712; rev:2;)
alert tcp $HOME_NET any -> 85.162.170.211 39462 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104713; rev:2;)
alert tcp $HOME_NET any -> 85.173.24.109 50492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104279; rev:2;)
alert tcp $HOME_NET any -> 85.173.220.221 38036 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106763; rev:2;)
alert tcp $HOME_NET any -> 87.15.14.109 59208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103909; rev:2;)
alert tcp $HOME_NET any -> 87.68.238.101 49479 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104711; rev:2;)
alert tcp $HOME_NET any -> 88.229.96.205 51803 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106265; rev:2;)
alert tcp $HOME_NET any -> 90.228.239.131 54971 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104709; rev:2;)
alert tcp $HOME_NET any -> 91.189.183.211 50758 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104708; rev:2;)
alert tcp $HOME_NET any -> 91.240.165.44 48222 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103747; rev:2;)
alert tcp $HOME_NET any -> 94.27.145.11 37216 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105062; rev:2;)
alert tcp $HOME_NET any -> 94.75.21.247 56593 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105763; rev:2;)
alert tcp $HOME_NET any -> 94.244.36.34 34585 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101871; rev:2;)
alert tcp $HOME_NET any -> 94.244.36.34 42903 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104949; rev:2;)
alert tcp $HOME_NET any -> 95.9.35.137 43208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103908; rev:2;)
alert tcp $HOME_NET any -> 95.56.232.109 45950 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101893; rev:2;)
alert tcp $HOME_NET any -> 95.155.243.196 38537 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104704; rev:2;)
alert tcp $HOME_NET any -> 96.66.24.241 39432 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104702; rev:2;)
alert tcp $HOME_NET any -> 96.125.128.2 35375 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104703; rev:2;)
alert tcp $HOME_NET any -> 98.36.141.73 43074 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104698; rev:2;)
alert tcp $HOME_NET any -> 98.252.87.232 40235 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104700; rev:2;)
alert tcp $HOME_NET any -> 101.29.22.214 59328 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104540; rev:2;)
alert tcp $HOME_NET any -> 101.30.245.217 37967 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104830; rev:2;)
alert tcp $HOME_NET any -> 101.59.79.119 40390 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104539; rev:2;)
alert tcp $HOME_NET any -> 101.59.79.119 44883 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106527; rev:2;)
alert tcp $HOME_NET any -> 101.74.52.251 15884 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106775; rev:2;)
alert tcp $HOME_NET any -> 101.108.6.60 33547 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105269; rev:2;)
alert tcp $HOME_NET any -> 101.108.8.2 60608 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106711; rev:2;)
alert tcp $HOME_NET any -> 101.108.69.64 50943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106526; rev:2;)
alert tcp $HOME_NET any -> 101.108.253.190 58711 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105268; rev:2;)
alert tcp $HOME_NET any -> 103.18.13.54 47482 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105267; rev:2;)
alert tcp $HOME_NET any -> 103.18.13.107 44599 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105738; rev:2;)
alert tcp $HOME_NET any -> 103.19.49.134 36622 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106155; rev:2;)
alert tcp $HOME_NET any -> 103.31.103.204 44082 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106525; rev:2;)
alert tcp $HOME_NET any -> 103.44.137.13 48345 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106264; rev:2;)
alert tcp $HOME_NET any -> 103.68.21.2 59852 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105111; rev:2;)
alert tcp $HOME_NET any -> 103.80.57.126 57047 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103879; rev:2;)
alert tcp $HOME_NET any -> 103.84.164.4 58136 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106263; rev:2;)
alert tcp $HOME_NET any -> 103.126.201.130 59258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106762; rev:2;)
alert tcp $HOME_NET any -> 103.156.176.162 53592 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105266; rev:2;)
alert tcp $HOME_NET any -> 103.160.130.178 33661 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105388; rev:2;)
alert tcp $HOME_NET any -> 103.160.130.178 47177 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106114; rev:2;)
alert tcp $HOME_NET any -> 103.164.128.184 47430 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104828; rev:2;)
alert tcp $HOME_NET any -> 103.167.175.121 55532 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106710; rev:2;)
alert tcp $HOME_NET any -> 103.179.240.227 38264 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106382; rev:2;)
alert tcp $HOME_NET any -> 103.179.240.227 39430 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105762; rev:2;)
alert tcp $HOME_NET any -> 103.203.210.102 46614 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105466; rev:2;)
alert tcp $HOME_NET any -> 103.203.210.102 57562 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104827; rev:2;)
alert tcp $HOME_NET any -> 103.226.187.112 60437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104948; rev:2;)
alert tcp $HOME_NET any -> 103.249.199.1 35620 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101894; rev:2;)
alert tcp $HOME_NET any -> 105.184.31.171 41073 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103878; rev:2;)
alert tcp $HOME_NET any -> 105.184.34.115 49289 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106435; rev:2;)
alert tcp $HOME_NET any -> 105.184.42.145 36337 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104076; rev:2;)
alert tcp $HOME_NET any -> 105.184.91.101 41339 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101870; rev:2;)
alert tcp $HOME_NET any -> 105.184.105.108 53225 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105297; rev:2;)
alert tcp $HOME_NET any -> 105.184.177.144 55771 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106154; rev:2;)
alert tcp $HOME_NET any -> 105.184.180.148 36857 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106381; rev:2;)
alert tcp $HOME_NET any -> 105.184.232.230 54381 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105841; rev:2;)
alert tcp $HOME_NET any -> 105.184.248.13 58983 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105604; rev:2;)
alert tcp $HOME_NET any -> 105.186.83.56 41911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103858; rev:2;)
alert tcp $HOME_NET any -> 105.186.83.83 55579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105059; rev:2;)
alert tcp $HOME_NET any -> 105.186.112.68 48101 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103857; rev:2;)
alert tcp $HOME_NET any -> 105.186.189.253 52445 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105058; rev:2;)
alert tcp $HOME_NET any -> 105.186.220.180 42471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106709; rev:2;)
alert tcp $HOME_NET any -> 105.187.26.237 37077 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103856; rev:2;)
alert tcp $HOME_NET any -> 105.187.32.75 37955 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106708; rev:2;)
alert tcp $HOME_NET any -> 105.224.34.139 60105 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106262; rev:2;)
alert tcp $HOME_NET any -> 105.224.60.250 44945 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106554; rev:2;)
alert tcp $HOME_NET any -> 105.224.242.127 37969 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106113; rev:2;)
alert tcp $HOME_NET any -> 105.225.48.83 57349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103803; rev:2;)
alert tcp $HOME_NET any -> 105.225.86.238 41431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101895; rev:2;)
alert tcp $HOME_NET any -> 106.1.9.225 50153 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104947; rev:2;)
alert tcp $HOME_NET any -> 106.40.242.20 46263 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104917; rev:2;)
alert tcp $HOME_NET any -> 106.57.6.80 53331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101896; rev:2;)
alert tcp $HOME_NET any -> 106.57.7.26 53331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104534; rev:2;)
alert tcp $HOME_NET any -> 109.236.44.241 37805 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106261; rev:2;)
alert tcp $HOME_NET any -> 109.236.46.215 59913 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101868; rev:2;)
alert tcp $HOME_NET any -> 110.136.98.236 48232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104946; rev:2;)
alert tcp $HOME_NET any -> 110.136.99.36 46081 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103855; rev:2;)
alert tcp $HOME_NET any -> 110.138.3.140 53454 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103877; rev:2;)
alert tcp $HOME_NET any -> 110.186.228.150 48917 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101897; rev:2;)
alert tcp $HOME_NET any -> 110.186.231.170 38543 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105265; rev:2;)
alert tcp $HOME_NET any -> 111.88.7.48 58109 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106707; rev:2;)
alert tcp $HOME_NET any -> 111.185.147.232 59432 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101867; rev:2;)
alert tcp $HOME_NET any -> 112.109.197.47 41093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105264; rev:2;)
alert tcp $HOME_NET any -> 112.113.68.159 41597 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104041; rev:2;)
alert tcp $HOME_NET any -> 112.198.128.164 47005 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106434; rev:2;)
alert tcp $HOME_NET any -> 112.198.130.112 42547 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104040; rev:2;)
alert tcp $HOME_NET any -> 112.198.193.5 40399 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104278; rev:2;)
alert tcp $HOME_NET any -> 112.198.238.18 46799 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104277; rev:2;)
alert tcp $HOME_NET any -> 112.198.238.30 44431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104945; rev:2;)
alert tcp $HOME_NET any -> 112.229.203.112 37340 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104826; rev:2;)
alert tcp $HOME_NET any -> 112.229.207.15 55943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106260; rev:2;)
alert tcp $HOME_NET any -> 112.231.205.143 43563 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106013; rev:2;)
alert tcp $HOME_NET any -> 112.237.49.125 43123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104079; rev:2;)
alert tcp $HOME_NET any -> 112.238.131.128 59841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105390; rev:2;)
alert tcp $HOME_NET any -> 112.240.165.27 60898 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105737; rev:2;)
alert tcp $HOME_NET any -> 112.242.152.173 55406 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105437; rev:2;)
alert tcp $HOME_NET any -> 112.246.19.248 41316 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105363; rev:2;)
alert tcp $HOME_NET any -> 112.248.17.144 35756 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105999; rev:2;)
alert tcp $HOME_NET any -> 112.248.81.132 53759 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106553; rev:2;)
alert tcp $HOME_NET any -> 112.248.105.114 40030 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106706; rev:2;)
alert tcp $HOME_NET any -> 112.248.108.140 41002 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105429; rev:2;)
alert tcp $HOME_NET any -> 112.248.115.39 40827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104829; rev:2;)
alert tcp $HOME_NET any -> 112.248.124.14 33320 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106380; rev:2;)
alert tcp $HOME_NET any -> 112.248.143.116 58363 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104823; rev:2;)
alert tcp $HOME_NET any -> 112.248.144.174 48971 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104956; rev:2;)
alert tcp $HOME_NET any -> 112.248.187.85 51786 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106112; rev:2;)
alert tcp $HOME_NET any -> 112.249.182.7 48054 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104916; rev:2;)
alert tcp $HOME_NET any -> 112.254.25.161 51093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103737; rev:2;)
alert tcp $HOME_NET any -> 112.254.26.64 51093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106705; rev:2;)
alert tcp $HOME_NET any -> 112.254.223.118 43542 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105350; rev:2;)
alert tcp $HOME_NET any -> 113.71.158.175 47074 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106761; rev:2;)
alert tcp $HOME_NET any -> 113.206.10.45 47047 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106523; rev:2;)
alert tcp $HOME_NET any -> 113.221.24.213 45414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103774; rev:2;)
alert tcp $HOME_NET any -> 113.221.25.216 37532 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105263; rev:2;)
alert tcp $HOME_NET any -> 113.221.38.108 40790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106285; rev:2;)
alert tcp $HOME_NET any -> 113.221.44.37 55307 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106259; rev:2;)
alert tcp $HOME_NET any -> 113.221.45.157 55307 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106704; rev:2;)
alert tcp $HOME_NET any -> 113.221.46.118 58353 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104139; rev:2;)
alert tcp $HOME_NET any -> 113.221.46.119 40057 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104138; rev:2;)
alert tcp $HOME_NET any -> 113.221.76.194 54955 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103736; rev:2;)
alert tcp $HOME_NET any -> 114.198.242.174 38879 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106153; rev:2;)
alert tcp $HOME_NET any -> 114.226.119.232 44763 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101898; rev:2;)
alert tcp $HOME_NET any -> 114.227.56.205 36941 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104276; rev:2;)
alert tcp $HOME_NET any -> 114.227.64.129 43953 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103773; rev:2;)
alert tcp $HOME_NET any -> 114.227.64.149 56600 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106258; rev:2;)
alert tcp $HOME_NET any -> 114.227.68.181 36904 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106111; rev:2;)
alert tcp $HOME_NET any -> 114.228.141.185 33800 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104142; rev:2;)
alert tcp $HOME_NET any -> 114.228.186.181 50519 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104538; rev:2;)
alert tcp $HOME_NET any -> 114.231.138.67 44129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105010; rev:2;)
alert tcp $HOME_NET any -> 114.239.63.214 39292 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106703; rev:2;)
alert tcp $HOME_NET any -> 115.48.11.166 38942 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106522; rev:2;)
alert tcp $HOME_NET any -> 115.48.138.178 58694 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105716; rev:2;)
alert tcp $HOME_NET any -> 115.48.152.21 36033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106521; rev:2;)
alert tcp $HOME_NET any -> 115.48.162.240 53193 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104821; rev:2;)
alert tcp $HOME_NET any -> 115.48.163.214 53193 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105262; rev:2;)
alert tcp $HOME_NET any -> 115.48.238.241 42081 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105389; rev:2;)
alert tcp $HOME_NET any -> 115.49.3.97 34652 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105041; rev:2;)
alert tcp $HOME_NET any -> 115.49.7.34 40290 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105349; rev:2;)
alert tcp $HOME_NET any -> 115.49.63.152 38441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105362; rev:2;)
alert tcp $HOME_NET any -> 115.49.73.224 59218 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105435; rev:2;)
alert tcp $HOME_NET any -> 115.49.107.36 60965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106110; rev:2;)
alert tcp $HOME_NET any -> 115.49.119.203 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104824; rev:2;)
alert tcp $HOME_NET any -> 115.49.211.162 48058 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105736; rev:2;)
alert tcp $HOME_NET any -> 115.50.4.162 52152 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105735; rev:2;)
alert tcp $HOME_NET any -> 115.50.7.192 56498 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106257; rev:2;)
alert tcp $HOME_NET any -> 115.50.24.135 45123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105379; rev:2;)
alert tcp $HOME_NET any -> 115.50.66.35 54801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106284; rev:2;)
alert tcp $HOME_NET any -> 115.50.95.179 56165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105761; rev:2;)
alert tcp $HOME_NET any -> 115.50.229.130 55514 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106256; rev:2;)
alert tcp $HOME_NET any -> 115.51.37.116 49531 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105734; rev:2;)
alert tcp $HOME_NET any -> 115.51.63.165 47075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106109; rev:2;)
alert tcp $HOME_NET any -> 115.51.89.58 38582 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105261; rev:2;)
alert tcp $HOME_NET any -> 115.51.108.246 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104275; rev:2;)
alert tcp $HOME_NET any -> 115.51.123.229 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106702; rev:2;)
alert tcp $HOME_NET any -> 115.51.180.51 37431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103849; rev:2;)
alert tcp $HOME_NET any -> 115.52.17.57 47267 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105260; rev:2;)
alert tcp $HOME_NET any -> 115.52.42.203 48646 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106255; rev:2;)
alert tcp $HOME_NET any -> 115.52.111.131 47075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105421; rev:2;)
alert tcp $HOME_NET any -> 115.52.179.227 44220 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106760; rev:2;)
alert tcp $HOME_NET any -> 115.52.196.207 34556 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106363; rev:2;)
alert tcp $HOME_NET any -> 115.52.251.82 40573 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105760; rev:2;)
alert tcp $HOME_NET any -> 115.53.209.24 38958 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105259; rev:2;)
alert tcp $HOME_NET any -> 115.53.209.141 35634 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106520; rev:2;)
alert tcp $HOME_NET any -> 115.53.243.171 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104819; rev:2;)
alert tcp $HOME_NET any -> 115.53.247.98 42289 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106219; rev:2;)
alert tcp $HOME_NET any -> 115.54.108.81 38694 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105258; rev:2;)
alert tcp $HOME_NET any -> 115.54.133.39 59395 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105405; rev:2;)
alert tcp $HOME_NET any -> 115.55.28.24 54414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105759; rev:2;)
alert tcp $HOME_NET any -> 115.55.37.155 44748 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106701; rev:2;)
alert tcp $HOME_NET any -> 115.55.50.151 37533 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106254; rev:2;)
alert tcp $HOME_NET any -> 115.55.52.39 37533 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105257; rev:2;)
alert tcp $HOME_NET any -> 115.55.54.214 42911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105351; rev:2;)
alert tcp $HOME_NET any -> 115.55.59.170 60306 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106379; rev:2;)
alert tcp $HOME_NET any -> 115.55.62.144 54772 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105445; rev:2;)
alert tcp $HOME_NET any -> 115.55.63.143 48086 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106253; rev:2;)
alert tcp $HOME_NET any -> 115.55.131.82 52575 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106218; rev:2;)
alert tcp $HOME_NET any -> 115.55.151.48 39130 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106700; rev:2;)
alert tcp $HOME_NET any -> 115.55.158.73 35137 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105256; rev:2;)
alert tcp $HOME_NET any -> 115.55.173.148 44037 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105400; rev:2;)
alert tcp $HOME_NET any -> 115.55.174.71 44634 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104822; rev:2;)
alert tcp $HOME_NET any -> 115.55.178.118 42943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105040; rev:2;)
alert tcp $HOME_NET any -> 115.55.190.64 35735 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105715; rev:2;)
alert tcp $HOME_NET any -> 115.55.194.73 43155 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105352; rev:2;)
alert tcp $HOME_NET any -> 115.55.207.5 48069 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105456; rev:2;)
alert tcp $HOME_NET any -> 115.55.221.28 43660 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105417; rev:2;)
alert tcp $HOME_NET any -> 115.55.223.34 55375 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105039; rev:2;)
alert tcp $HOME_NET any -> 115.55.226.66 37950 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105603; rev:2;)
alert tcp $HOME_NET any -> 115.55.243.51 37495 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105038; rev:2;)
alert tcp $HOME_NET any -> 115.55.243.215 56839 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105840; rev:2;)
alert tcp $HOME_NET any -> 115.55.244.240 35253 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105403; rev:2;)
alert tcp $HOME_NET any -> 115.55.253.18 51853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105449; rev:2;)
alert tcp $HOME_NET any -> 115.56.12.39 52565 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105253; rev:2;)
alert tcp $HOME_NET any -> 115.56.96.161 54414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106108; rev:2;)
alert tcp $HOME_NET any -> 115.56.102.220 52578 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106519; rev:2;)
alert tcp $HOME_NET any -> 115.56.109.217 51650 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106217; rev:2;)
alert tcp $HOME_NET any -> 115.56.124.86 54294 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105839; rev:2;)
alert tcp $HOME_NET any -> 115.56.157.163 33718 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106699; rev:2;)
alert tcp $HOME_NET any -> 115.56.157.204 43031 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106698; rev:2;)
alert tcp $HOME_NET any -> 115.56.159.4 56622 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106252; rev:2;)
alert tcp $HOME_NET any -> 115.57.69.54 54406 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105758; rev:2;)
alert tcp $HOME_NET any -> 115.57.80.149 55734 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105406; rev:2;)
alert tcp $HOME_NET any -> 115.57.81.140 43219 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106251; rev:2;)
alert tcp $HOME_NET any -> 115.57.167.67 35149 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105757; rev:2;)
alert tcp $HOME_NET any -> 115.57.207.68 49426 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106759; rev:2;)
alert tcp $HOME_NET any -> 115.57.213.127 43509 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106697; rev:2;)
alert tcp $HOME_NET any -> 115.57.239.68 59935 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106518; rev:2;)
alert tcp $HOME_NET any -> 115.57.251.81 37477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105602; rev:2;)
alert tcp $HOME_NET any -> 115.57.253.17 53774 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105601; rev:2;)
alert tcp $HOME_NET any -> 115.57.254.136 42278 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105733; rev:2;)
alert tcp $HOME_NET any -> 115.58.80.45 58927 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105452; rev:2;)
alert tcp $HOME_NET any -> 115.58.80.135 41804 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106758; rev:2;)
alert tcp $HOME_NET any -> 115.58.86.52 34597 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104915; rev:2;)
alert tcp $HOME_NET any -> 115.58.91.176 40931 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105355; rev:2;)
alert tcp $HOME_NET any -> 115.58.95.71 41245 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105756; rev:2;)
alert tcp $HOME_NET any -> 115.58.97.98 60477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106517; rev:2;)
alert tcp $HOME_NET any -> 115.58.99.114 60477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104812; rev:2;)
alert tcp $HOME_NET any -> 115.58.128.53 38060 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105255; rev:2;)
alert tcp $HOME_NET any -> 115.58.178.178 33235 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106107; rev:2;)
alert tcp $HOME_NET any -> 115.58.180.245 33235 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104914; rev:2;)
alert tcp $HOME_NET any -> 115.58.253.176 36067 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106516; rev:2;)
alert tcp $HOME_NET any -> 115.59.231.52 49670 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106250; rev:2;)
alert tcp $HOME_NET any -> 115.60.209.34 51257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105391; rev:2;)
alert tcp $HOME_NET any -> 115.60.221.175 41921 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105732; rev:2;)
alert tcp $HOME_NET any -> 115.60.223.220 39065 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106152; rev:2;)
alert tcp $HOME_NET any -> 115.60.252.50 38555 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105838; rev:2;)
alert tcp $HOME_NET any -> 115.60.253.104 42814 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105755; rev:2;)
alert tcp $HOME_NET any -> 115.61.107.195 57147 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103772; rev:2;)
alert tcp $HOME_NET any -> 115.62.146.115 39533 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105641; rev:2;)
alert tcp $HOME_NET any -> 115.62.153.120 40604 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106150; rev:2;)
alert tcp $HOME_NET any -> 115.62.156.245 41068 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106106; rev:2;)
alert tcp $HOME_NET any -> 115.62.176.189 57183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106362; rev:2;)
alert tcp $HOME_NET any -> 115.62.181.25 57183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105402; rev:2;)
alert tcp $HOME_NET any -> 115.62.184.123 60624 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106249; rev:2;)
alert tcp $HOME_NET any -> 115.62.184.242 60983 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106248; rev:2;)
alert tcp $HOME_NET any -> 115.62.185.99 41114 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105714; rev:2;)
alert tcp $HOME_NET any -> 115.63.11.37 60272 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106515; rev:2;)
alert tcp $HOME_NET any -> 115.63.14.35 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105252; rev:2;)
alert tcp $HOME_NET any -> 115.63.14.195 42924 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105754; rev:2;)
alert tcp $HOME_NET any -> 115.63.84.231 59738 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105404; rev:2;)
alert tcp $HOME_NET any -> 115.63.86.151 59738 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105251; rev:2;)
alert tcp $HOME_NET any -> 115.63.144.10 52391 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104913; rev:2;)
alert tcp $HOME_NET any -> 115.63.146.71 34252 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106361; rev:2;)
alert tcp $HOME_NET any -> 115.63.146.138 55514 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106696; rev:2;)
alert tcp $HOME_NET any -> 115.63.206.246 47417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105753; rev:2;)
alert tcp $HOME_NET any -> 115.96.130.110 40029 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106552; rev:2;)
alert tcp $HOME_NET any -> 115.97.136.139 51720 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106551; rev:2;)
alert tcp $HOME_NET any -> 115.192.97.236 47571 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104990; rev:2;)
alert tcp $HOME_NET any -> 115.193.205.187 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104533; rev:2;)
alert tcp $HOME_NET any -> 115.194.8.14 57404 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106514; rev:2;)
alert tcp $HOME_NET any -> 115.205.150.31 37201 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106513; rev:2;)
alert tcp $HOME_NET any -> 115.230.76.101 37221 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106151; rev:2;)
alert tcp $HOME_NET any -> 116.68.162.210 60207 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106512; rev:2;)
alert tcp $HOME_NET any -> 116.248.83.141 56727 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106511; rev:2;)
alert tcp $HOME_NET any -> 117.63.74.133 39063 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105254; rev:2;)
alert tcp $HOME_NET any -> 117.63.112.125 41376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104274; rev:2;)
alert tcp $HOME_NET any -> 117.131.92.150 59473 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103876; rev:2;)
alert tcp $HOME_NET any -> 117.199.77.239 52881 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104820; rev:2;)
alert tcp $HOME_NET any -> 117.240.237.18 45919 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105057; rev:2;)
alert tcp $HOME_NET any -> 117.242.152.21 42166 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106149; rev:2;)
alert tcp $HOME_NET any -> 117.245.135.241 48870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106247; rev:2;)
alert tcp $HOME_NET any -> 117.245.139.85 44126 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104818; rev:2;)
alert tcp $HOME_NET any -> 117.245.141.241 45847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105640; rev:2;)
alert tcp $HOME_NET any -> 117.252.240.213 32809 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105407; rev:2;)
alert tcp $HOME_NET any -> 118.232.137.101 58455 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106360; rev:2;)
alert tcp $HOME_NET any -> 119.73.59.113 51110 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106510; rev:2;)
alert tcp $HOME_NET any -> 119.73.59.113 60742 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106246; rev:2;)
alert tcp $HOME_NET any -> 119.73.59.113 60801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105120; rev:2;)
alert tcp $HOME_NET any -> 119.116.121.152 35357 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103850; rev:2;)
alert tcp $HOME_NET any -> 119.127.7.102 56002 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106148; rev:2;)
alert tcp $HOME_NET any -> 119.163.32.113 50032 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105250; rev:2;)
alert tcp $HOME_NET any -> 119.165.89.154 38309 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104814; rev:2;)
alert tcp $HOME_NET any -> 119.166.73.124 52203 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106509; rev:2;)
alert tcp $HOME_NET any -> 119.166.194.8 35798 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101865; rev:2;)
alert tcp $HOME_NET any -> 119.179.30.73 48215 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101883; rev:2;)
alert tcp $HOME_NET any -> 119.179.251.19 34111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105393; rev:2;)
alert tcp $HOME_NET any -> 119.179.254.3 36720 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105378; rev:2;)
alert tcp $HOME_NET any -> 119.180.244.119 42792 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105386; rev:2;)
alert tcp $HOME_NET any -> 119.184.4.100 48083 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105037; rev:2;)
alert tcp $HOME_NET any -> 119.185.132.53 44820 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105036; rev:2;)
alert tcp $HOME_NET any -> 119.185.241.242 59789 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105837; rev:2;)
alert tcp $HOME_NET any -> 119.187.237.130 43735 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105117; rev:2;)
alert tcp $HOME_NET any -> 119.189.215.204 39465 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106378; rev:2;)
alert tcp $HOME_NET any -> 119.189.238.246 36957 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106245; rev:2;)
alert tcp $HOME_NET any -> 119.189.249.202 39164 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106508; rev:2;)
alert tcp $HOME_NET any -> 119.236.238.176 38079 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104816; rev:2;)
alert tcp $HOME_NET any -> 120.28.135.4 35562 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106695; rev:2;)
alert tcp $HOME_NET any -> 120.28.139.121 50861 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104273; rev:2;)
alert tcp $HOME_NET any -> 120.28.144.161 39233 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105639; rev:2;)
alert tcp $HOME_NET any -> 120.28.161.11 57965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104024; rev:2;)
alert tcp $HOME_NET any -> 120.28.161.60 57495 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106694; rev:2;)
alert tcp $HOME_NET any -> 120.28.166.185 48483 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106105; rev:2;)
alert tcp $HOME_NET any -> 120.28.189.248 42675 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101899; rev:2;)
alert tcp $HOME_NET any -> 120.28.189.248 50610 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105249; rev:2;)
alert tcp $HOME_NET any -> 120.28.193.113 47346 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105248; rev:2;)
alert tcp $HOME_NET any -> 120.28.193.113 53964 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106507; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 38048 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104137; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 41877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103771; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 51325 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105247; rev:2;)
alert tcp $HOME_NET any -> 120.28.196.250 50536 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106693; rev:2;)
alert tcp $HOME_NET any -> 120.28.197.69 36816 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105246; rev:2;)
alert tcp $HOME_NET any -> 120.28.197.69 53898 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106692; rev:2;)
alert tcp $HOME_NET any -> 120.28.199.24 36535 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101900; rev:2;)
alert tcp $HOME_NET any -> 120.28.200.110 33040 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105119; rev:2;)
alert tcp $HOME_NET any -> 120.28.201.138 54526 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106506; rev:2;)
alert tcp $HOME_NET any -> 120.28.201.138 55930 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105656; rev:2;)
alert tcp $HOME_NET any -> 120.28.212.172 40293 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105245; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.36 39145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106244; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.50 47233 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104281; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.116 56895 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106243; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.200 60458 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104272; rev:2;)
alert tcp $HOME_NET any -> 120.28.219.231 49376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106242; rev:2;)
alert tcp $HOME_NET any -> 121.61.49.44 46204 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104136; rev:2;)
alert tcp $HOME_NET any -> 121.231.116.192 38256 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106691; rev:2;)
alert tcp $HOME_NET any -> 122.99.60.138 56774 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103854; rev:2;)
alert tcp $HOME_NET any -> 122.139.13.133 53319 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106690; rev:2;)
alert tcp $HOME_NET any -> 122.139.18.141 39877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104135; rev:2;)
alert tcp $HOME_NET any -> 122.233.29.62 38332 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104038; rev:2;)
alert tcp $HOME_NET any -> 122.241.130.212 45870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104037; rev:2;)
alert tcp $HOME_NET any -> 123.4.192.31 48226 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105364; rev:2;)
alert tcp $HOME_NET any -> 123.4.236.242 34736 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105244; rev:2;)
alert tcp $HOME_NET any -> 123.4.249.119 44171 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106505; rev:2;)
alert tcp $HOME_NET any -> 123.4.251.165 55576 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106757; rev:2;)
alert tcp $HOME_NET any -> 123.5.132.162 52455 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106504; rev:2;)
alert tcp $HOME_NET any -> 123.5.152.25 42329 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105401; rev:2;)
alert tcp $HOME_NET any -> 123.5.170.8 46113 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106241; rev:2;)
alert tcp $HOME_NET any -> 123.5.186.24 33440 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105361; rev:2;)
alert tcp $HOME_NET any -> 123.7.227.70 42873 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106550; rev:2;)
alert tcp $HOME_NET any -> 123.9.80.85 51154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105243; rev:2;)
alert tcp $HOME_NET any -> 123.9.192.163 56498 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105242; rev:2;)
alert tcp $HOME_NET any -> 123.10.225.139 46476 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105431; rev:2;)
alert tcp $HOME_NET any -> 123.11.7.143 37624 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105713; rev:2;)
alert tcp $HOME_NET any -> 123.11.11.52 48079 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105426; rev:2;)
alert tcp $HOME_NET any -> 123.11.64.164 34556 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105600; rev:2;)
alert tcp $HOME_NET any -> 123.11.67.64 36420 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106240; rev:2;)
alert tcp $HOME_NET any -> 123.11.70.219 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106126; rev:2;)
alert tcp $HOME_NET any -> 123.11.79.171 60170 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106359; rev:2;)
alert tcp $HOME_NET any -> 123.11.98.235 36589 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106756; rev:2;)
alert tcp $HOME_NET any -> 123.11.193.146 39743 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106358; rev:2;)
alert tcp $HOME_NET any -> 123.11.217.41 39743 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105599; rev:2;)
alert tcp $HOME_NET any -> 123.12.11.116 33633 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106503; rev:2;)
alert tcp $HOME_NET any -> 123.12.27.20 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105598; rev:2;)
alert tcp $HOME_NET any -> 123.12.31.141 60566 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104815; rev:2;)
alert tcp $HOME_NET any -> 123.12.158.240 43156 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105450; rev:2;)
alert tcp $HOME_NET any -> 123.12.196.3 35706 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106689; rev:2;)
alert tcp $HOME_NET any -> 123.12.232.220 56476 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106688; rev:2;)
alert tcp $HOME_NET any -> 123.13.3.95 49993 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104809; rev:2;)
alert tcp $HOME_NET any -> 123.13.27.188 58344 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105731; rev:2;)
alert tcp $HOME_NET any -> 123.13.54.33 47505 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106687; rev:2;)
alert tcp $HOME_NET any -> 123.14.33.27 42713 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106755; rev:2;)
alert tcp $HOME_NET any -> 123.14.81.41 47055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104805; rev:2;)
alert tcp $HOME_NET any -> 123.14.85.183 47055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106104; rev:2;)
alert tcp $HOME_NET any -> 123.14.90.5 47055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106502; rev:2;)
alert tcp $HOME_NET any -> 123.14.123.154 33340 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105712; rev:2;)
alert tcp $HOME_NET any -> 123.14.215.182 57457 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106501; rev:2;)
alert tcp $HOME_NET any -> 123.14.252.181 54573 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105206; rev:2;)
alert tcp $HOME_NET any -> 123.15.67.95 37431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104271; rev:2;)
alert tcp $HOME_NET any -> 123.129.104.81 45165 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104912; rev:2;)
alert tcp $HOME_NET any -> 123.129.130.4 34119 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105360; rev:2;)
alert tcp $HOME_NET any -> 123.129.130.19 38163 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104804; rev:2;)
alert tcp $HOME_NET any -> 123.129.130.148 58971 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106686; rev:2;)
alert tcp $HOME_NET any -> 123.129.131.98 48006 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106685; rev:2;)
alert tcp $HOME_NET any -> 123.129.134.33 47336 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105752; rev:2;)
alert tcp $HOME_NET any -> 123.132.166.255 41245 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101864; rev:2;)
alert tcp $HOME_NET any -> 123.132.245.94 33681 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104134; rev:2;)
alert tcp $HOME_NET any -> 123.161.90.221 49111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101901; rev:2;)
alert tcp $HOME_NET any -> 123.172.56.34 44140 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103735; rev:2;)
alert tcp $HOME_NET any -> 123.173.73.226 41793 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103734; rev:2;)
alert tcp $HOME_NET any -> 123.234.191.177 42672 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106103; rev:2;)
alert tcp $HOME_NET any -> 123.245.97.124 58336 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104532; rev:2;)
alert tcp $HOME_NET any -> 123.245.99.52 39875 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103770; rev:2;)
alert tcp $HOME_NET any -> 123.252.17.79 41354 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103732; rev:2;)
alert tcp $HOME_NET any -> 124.6.165.86 60366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106377; rev:2;)
alert tcp $HOME_NET any -> 124.6.167.121 45202 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103657; rev:2;)
alert tcp $HOME_NET any -> 124.6.167.121 57352 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104537; rev:2;)
alert tcp $HOME_NET any -> 124.6.168.74 42130 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105240; rev:2;)
alert tcp $HOME_NET any -> 124.6.169.46 58258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104036; rev:2;)
alert tcp $HOME_NET any -> 124.6.185.132 48257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103731; rev:2;)
alert tcp $HOME_NET any -> 124.131.4.86 37963 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105359; rev:2;)
alert tcp $HOME_NET any -> 124.131.139.209 57349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106216; rev:2;)
alert tcp $HOME_NET any -> 124.135.10.58 51825 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103650; rev:2;)
alert tcp $HOME_NET any -> 124.161.116.2 39053 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105296; rev:2;)
alert tcp $HOME_NET any -> 124.234.131.24 53745 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106376; rev:2;)
alert tcp $HOME_NET any -> 124.234.219.141 44247 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106684; rev:2;)
alert tcp $HOME_NET any -> 124.235.106.150 39827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103730; rev:2;)
alert tcp $HOME_NET any -> 124.235.130.21 59252 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103852; rev:2;)
alert tcp $HOME_NET any -> 125.40.74.144 60027 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105451; rev:2;)
alert tcp $HOME_NET any -> 125.40.113.33 33011 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105380; rev:2;)
alert tcp $HOME_NET any -> 125.40.158.205 34448 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106160; rev:2;)
alert tcp $HOME_NET any -> 125.41.2.160 50746 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106102; rev:2;)
alert tcp $HOME_NET any -> 125.41.8.203 49314 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105035; rev:2;)
alert tcp $HOME_NET any -> 125.41.183.143 34893 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106215; rev:2;)
alert tcp $HOME_NET any -> 125.41.211.58 48188 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105440; rev:2;)
alert tcp $HOME_NET any -> 125.41.228.123 58883 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106754; rev:2;)
alert tcp $HOME_NET any -> 125.41.231.68 59866 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105239; rev:2;)
alert tcp $HOME_NET any -> 125.41.240.68 40451 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104808; rev:2;)
alert tcp $HOME_NET any -> 125.42.14.164 53770 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105439; rev:2;)
alert tcp $HOME_NET any -> 125.42.25.36 44732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105238; rev:2;)
alert tcp $HOME_NET any -> 125.43.5.41 34827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106500; rev:2;)
alert tcp $HOME_NET any -> 125.43.8.244 34827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101902; rev:2;)
alert tcp $HOME_NET any -> 125.43.36.129 38648 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105836; rev:2;)
alert tcp $HOME_NET any -> 125.43.37.95 40928 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105237; rev:2;)
alert tcp $HOME_NET any -> 125.43.39.192 56239 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105377; rev:2;)
alert tcp $HOME_NET any -> 125.43.43.232 50073 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106239; rev:2;)
alert tcp $HOME_NET any -> 125.43.45.149 33353 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105414; rev:2;)
alert tcp $HOME_NET any -> 125.43.105.61 50073 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105235; rev:2;)
alert tcp $HOME_NET any -> 125.43.105.193 34984 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104810; rev:2;)
alert tcp $HOME_NET any -> 125.43.226.173 40813 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104911; rev:2;)
alert tcp $HOME_NET any -> 125.44.39.235 49107 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105730; rev:2;)
alert tcp $HOME_NET any -> 125.44.60.118 38038 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105998; rev:2;)
alert tcp $HOME_NET any -> 125.44.190.92 60624 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106683; rev:2;)
alert tcp $HOME_NET any -> 125.44.214.233 54441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106147; rev:2;)
alert tcp $HOME_NET any -> 125.45.9.243 58985 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105751; rev:2;)
alert tcp $HOME_NET any -> 125.45.49.209 37734 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105376; rev:2;)
alert tcp $HOME_NET any -> 125.45.65.137 35631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106101; rev:2;)
alert tcp $HOME_NET any -> 125.46.198.106 33483 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106549; rev:2;)
alert tcp $HOME_NET any -> 125.47.85.70 56972 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106238; rev:2;)
alert tcp $HOME_NET any -> 125.47.87.230 46876 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106015; rev:2;)
alert tcp $HOME_NET any -> 125.47.225.19 52801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104910; rev:2;)
alert tcp $HOME_NET any -> 125.47.249.24 50285 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105454; rev:2;)
alert tcp $HOME_NET any -> 125.65.146.164 50215 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101903; rev:2;)
alert tcp $HOME_NET any -> 125.78.40.165 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104270; rev:2;)
alert tcp $HOME_NET any -> 125.106.114.59 42629 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106375; rev:2;)
alert tcp $HOME_NET any -> 125.119.75.223 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106374; rev:2;)
alert tcp $HOME_NET any -> 125.126.115.194 35284 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106753; rev:2;)
alert tcp $HOME_NET any -> 125.160.139.10 40058 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104035; rev:2;)
alert tcp $HOME_NET any -> 125.160.142.97 33577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106499; rev:2;)
alert tcp $HOME_NET any -> 126.76.103.220 37207 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104813; rev:2;)
alert tcp $HOME_NET any -> 130.12.209.132 49060 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106237; rev:2;)
alert tcp $HOME_NET any -> 130.12.209.147 43312 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101863; rev:2;)
alert tcp $HOME_NET any -> 136.60.32.162 35693 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105423; rev:2;)
alert tcp $HOME_NET any -> 138.204.196.244 59781 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105236; rev:2;)
alert tcp $HOME_NET any -> 138.204.196.254 45562 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101904; rev:2;)
alert tcp $HOME_NET any -> 154.23.75.187 58800 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106357; rev:2;)
alert tcp $HOME_NET any -> 154.223.128.222 33167 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106498; rev:2;)
alert tcp $HOME_NET any -> 154.223.128.222 48066 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105118; rev:2;)
alert tcp $HOME_NET any -> 157.66.146.183 44492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105835; rev:2;)
alert tcp $HOME_NET any -> 158.255.83.204 53895 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104802; rev:2;)
alert tcp $HOME_NET any -> 158.255.83.212 41188 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106100; rev:2;)
alert tcp $HOME_NET any -> 159.196.55.40 50111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104801; rev:2;)
alert tcp $HOME_NET any -> 160.250.51.11 37175 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106778; rev:2;)
alert tcp $HOME_NET any -> 160.250.51.11 53906 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106139; rev:2;)
alert tcp $HOME_NET any -> 162.246.27.201 42053 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106236; rev:2;)
alert tcp $HOME_NET any -> 167.250.158.32 46664 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101862; rev:2;)
alert tcp $HOME_NET any -> 170.84.132.250 39933 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104531; rev:2;)
alert tcp $HOME_NET any -> 170.84.132.250 59150 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106373; rev:2;)
alert tcp $HOME_NET any -> 170.254.10.213 35081 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104909; rev:2;)
alert tcp $HOME_NET any -> 174.105.154.212 55690 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104800; rev:2;)
alert tcp $HOME_NET any -> 175.0.60.188 40182 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103729; rev:2;)
alert tcp $HOME_NET any -> 175.9.132.63 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106497; rev:2;)
alert tcp $HOME_NET any -> 175.9.165.183 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105234; rev:2;)
alert tcp $HOME_NET any -> 175.9.166.233 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104033; rev:2;)
alert tcp $HOME_NET any -> 175.30.114.108 44656 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104871; rev:2;)
alert tcp $HOME_NET any -> 175.31.168.229 50764 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106682; rev:2;)
alert tcp $HOME_NET any -> 175.43.85.192 57642 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106159; rev:2;)
alert tcp $HOME_NET any -> 175.43.151.10 40697 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106282; rev:2;)
alert tcp $HOME_NET any -> 175.44.156.36 37033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103728; rev:2;)
alert tcp $HOME_NET any -> 175.107.229.50 48713 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105034; rev:2;)
alert tcp $HOME_NET any -> 175.153.135.75 53709 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106431; rev:2;)
alert tcp $HOME_NET any -> 176.106.241.72 39541 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104799; rev:2;)
alert tcp $HOME_NET any -> 177.84.28.156 44034 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105056; rev:2;)
alert tcp $HOME_NET any -> 177.86.229.12 53455 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101861; rev:2;)
alert tcp $HOME_NET any -> 179.154.80.249 53339 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106681; rev:2;)
alert tcp $HOME_NET any -> 180.104.55.42 40721 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104908; rev:2;)
alert tcp $HOME_NET any -> 180.107.123.227 46139 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105033; rev:2;)
alert tcp $HOME_NET any -> 180.115.67.118 58208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105116; rev:2;)
alert tcp $HOME_NET any -> 180.115.168.174 34414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101884; rev:2;)
alert tcp $HOME_NET any -> 180.116.71.179 36941 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103727; rev:2;)
alert tcp $HOME_NET any -> 180.120.0.49 44129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106235; rev:2;)
alert tcp $HOME_NET any -> 180.190.185.100 51007 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104530; rev:2;)
alert tcp $HOME_NET any -> 180.190.186.97 52355 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104269; rev:2;)
alert tcp $HOME_NET any -> 180.190.240.131 55186 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106496; rev:2;)
alert tcp $HOME_NET any -> 180.191.16.206 48801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103726; rev:2;)
alert tcp $HOME_NET any -> 180.191.22.170 52866 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103851; rev:2;)
alert tcp $HOME_NET any -> 180.191.32.197 49164 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104034; rev:2;)
alert tcp $HOME_NET any -> 180.191.34.236 40802 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106437; rev:2;)
alert tcp $HOME_NET any -> 180.191.34.236 57057 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101905; rev:2;)
alert tcp $HOME_NET any -> 180.191.36.99 55946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101906; rev:2;)
alert tcp $HOME_NET any -> 180.191.40.108 46389 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104133; rev:2;)
alert tcp $HOME_NET any -> 180.191.42.15 44577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103725; rev:2;)
alert tcp $HOME_NET any -> 180.191.49.27 47666 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106138; rev:2;)
alert tcp $HOME_NET any -> 180.244.47.60 40341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106680; rev:2;)
alert tcp $HOME_NET any -> 180.244.61.239 60849 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104268; rev:2;)
alert tcp $HOME_NET any -> 180.245.43.93 37596 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101860; rev:2;)
alert tcp $HOME_NET any -> 180.252.221.56 45321 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106679; rev:2;)
alert tcp $HOME_NET any -> 182.112.13.124 56784 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104944; rev:2;)
alert tcp $HOME_NET any -> 182.112.28.50 36154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106234; rev:2;)
alert tcp $HOME_NET any -> 182.112.29.95 57957 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106430; rev:2;)
alert tcp $HOME_NET any -> 182.112.30.71 38364 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105375; rev:2;)
alert tcp $HOME_NET any -> 182.112.182.6 41117 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106372; rev:2;)
alert tcp $HOME_NET any -> 182.112.210.5 50682 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106678; rev:2;)
alert tcp $HOME_NET any -> 182.113.12.216 54485 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104793; rev:2;)
alert tcp $HOME_NET any -> 182.113.29.55 57658 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105115; rev:2;)
alert tcp $HOME_NET any -> 182.113.31.138 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106677; rev:2;)
alert tcp $HOME_NET any -> 182.113.35.132 45947 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106495; rev:2;)
alert tcp $HOME_NET any -> 182.113.37.210 57854 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106099; rev:2;)
alert tcp $HOME_NET any -> 182.113.199.122 58281 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104792; rev:2;)
alert tcp $HOME_NET any -> 182.113.200.66 35049 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106098; rev:2;)
alert tcp $HOME_NET any -> 182.114.32.165 37031 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106676; rev:2;)
alert tcp $HOME_NET any -> 182.114.248.139 32824 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105054; rev:2;)
alert tcp $HOME_NET any -> 182.116.14.167 42605 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106494; rev:2;)
alert tcp $HOME_NET any -> 182.116.36.188 37734 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105022; rev:2;)
alert tcp $HOME_NET any -> 182.116.38.177 53412 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105597; rev:2;)
alert tcp $HOME_NET any -> 182.116.64.244 57147 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105233; rev:2;)
alert tcp $HOME_NET any -> 182.116.112.64 57996 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105750; rev:2;)
alert tcp $HOME_NET any -> 182.116.119.23 38176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104791; rev:2;)
alert tcp $HOME_NET any -> 182.116.123.155 56622 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105232; rev:2;)
alert tcp $HOME_NET any -> 182.117.68.170 45884 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105374; rev:2;)
alert tcp $HOME_NET any -> 182.117.78.238 56888 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106429; rev:2;)
alert tcp $HOME_NET any -> 182.117.79.97 58056 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106097; rev:2;)
alert tcp $HOME_NET any -> 182.117.80.106 39130 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106428; rev:2;)
alert tcp $HOME_NET any -> 182.117.104.197 35137 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106233; rev:2;)
alert tcp $HOME_NET any -> 182.117.107.119 60480 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105729; rev:2;)
alert tcp $HOME_NET any -> 182.117.116.35 48461 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105373; rev:2;)
alert tcp $HOME_NET any -> 182.117.165.86 55309 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106548; rev:2;)
alert tcp $HOME_NET any -> 182.118.244.54 49806 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105448; rev:2;)
alert tcp $HOME_NET any -> 182.118.244.134 34417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106371; rev:2;)
alert tcp $HOME_NET any -> 182.118.247.217 34417 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105231; rev:2;)
alert tcp $HOME_NET any -> 182.119.68.47 43814 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105438; rev:2;)
alert tcp $HOME_NET any -> 182.119.116.53 60344 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105372; rev:2;)
alert tcp $HOME_NET any -> 182.119.160.167 51257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105596; rev:2;)
alert tcp $HOME_NET any -> 182.119.162.49 51257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104790; rev:2;)
alert tcp $HOME_NET any -> 182.119.191.143 41594 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105436; rev:2;)
alert tcp $HOME_NET any -> 182.119.250.57 49635 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105447; rev:2;)
alert tcp $HOME_NET any -> 182.120.11.141 51655 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105987; rev:2;)
alert tcp $HOME_NET any -> 182.120.43.111 47591 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104032; rev:2;)
alert tcp $HOME_NET any -> 182.121.11.34 39191 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105358; rev:2;)
alert tcp $HOME_NET any -> 182.121.172.105 50668 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106232; rev:2;)
alert tcp $HOME_NET any -> 182.121.181.105 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105460; rev:2;)
alert tcp $HOME_NET any -> 182.121.236.181 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106146; rev:2;)
alert tcp $HOME_NET any -> 182.121.239.171 36990 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105413; rev:2;)
alert tcp $HOME_NET any -> 182.122.144.142 52114 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105383; rev:2;)
alert tcp $HOME_NET any -> 182.122.193.170 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103769; rev:2;)
alert tcp $HOME_NET any -> 182.122.195.174 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105595; rev:2;)
alert tcp $HOME_NET any -> 182.122.232.225 45123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105702; rev:2;)
alert tcp $HOME_NET any -> 182.123.252.49 55576 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106493; rev:2;)
alert tcp $HOME_NET any -> 182.124.20.96 57190 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105441; rev:2;)
alert tcp $HOME_NET any -> 182.124.36.215 59176 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105230; rev:2;)
alert tcp $HOME_NET any -> 182.124.164.121 44732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106231; rev:2;)
alert tcp $HOME_NET any -> 182.126.84.3 60500 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105434; rev:2;)
alert tcp $HOME_NET any -> 182.126.84.63 48055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106547; rev:2;)
alert tcp $HOME_NET any -> 182.126.87.82 58075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106492; rev:2;)
alert tcp $HOME_NET any -> 182.126.93.152 58339 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105749; rev:2;)
alert tcp $HOME_NET any -> 182.126.94.246 36732 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106281; rev:2;)
alert tcp $HOME_NET any -> 182.126.95.127 35631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106427; rev:2;)
alert tcp $HOME_NET any -> 182.126.103.229 37256 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106675; rev:2;)
alert tcp $HOME_NET any -> 182.126.107.136 58026 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104907; rev:2;)
alert tcp $HOME_NET any -> 182.126.113.144 33201 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105728; rev:2;)
alert tcp $HOME_NET any -> 182.126.114.159 50568 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105229; rev:2;)
alert tcp $HOME_NET any -> 182.126.116.9 40413 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105711; rev:2;)
alert tcp $HOME_NET any -> 182.126.116.12 55360 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106096; rev:2;)
alert tcp $HOME_NET any -> 182.126.122.180 45536 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105430; rev:2;)
alert tcp $HOME_NET any -> 182.126.201.81 46437 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106674; rev:2;)
alert tcp $HOME_NET any -> 182.126.201.152 43849 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105399; rev:2;)
alert tcp $HOME_NET any -> 182.126.248.175 50532 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106673; rev:2;)
alert tcp $HOME_NET any -> 182.127.5.251 38733 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106095; rev:2;)
alert tcp $HOME_NET any -> 182.127.31.102 46258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105834; rev:2;)
alert tcp $HOME_NET any -> 182.127.71.3 48418 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106672; rev:2;)
alert tcp $HOME_NET any -> 182.127.84.19 32929 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106491; rev:2;)
alert tcp $HOME_NET any -> 182.127.85.253 53702 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104787; rev:2;)
alert tcp $HOME_NET any -> 182.127.110.105 38298 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106145; rev:2;)
alert tcp $HOME_NET any -> 182.127.113.69 57854 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104867; rev:2;)
alert tcp $HOME_NET any -> 182.127.123.182 45947 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105748; rev:2;)
alert tcp $HOME_NET any -> 182.127.133.198 42943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106230; rev:2;)
alert tcp $HOME_NET any -> 182.127.152.170 43722 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105747; rev:2;)
alert tcp $HOME_NET any -> 182.127.160.17 58026 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105371; rev:2;)
alert tcp $HOME_NET any -> 182.127.164.233 54829 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106490; rev:2;)
alert tcp $HOME_NET any -> 182.127.165.77 43661 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105727; rev:2;)
alert tcp $HOME_NET any -> 182.127.166.145 47115 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104906; rev:2;)
alert tcp $HOME_NET any -> 182.127.168.147 41164 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105637; rev:2;)
alert tcp $HOME_NET any -> 182.127.191.30 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106489; rev:2;)
alert tcp $HOME_NET any -> 182.127.222.30 58000 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105357; rev:2;)
alert tcp $HOME_NET any -> 182.146.222.251 41175 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104075; rev:2;)
alert tcp $HOME_NET any -> 182.240.8.122 58787 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105228; rev:2;)
alert tcp $HOME_NET any -> 182.240.10.30 58787 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106546; rev:2;)
alert tcp $HOME_NET any -> 183.12.173.166 35769 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105746; rev:2;)
alert tcp $HOME_NET any -> 183.23.136.70 54790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104267; rev:2;)
alert tcp $HOME_NET any -> 183.23.136.171 35951 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104132; rev:2;)
alert tcp $HOME_NET any -> 183.63.8.194 50991 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103724; rev:2;)
alert tcp $HOME_NET any -> 183.134.152.81 38332 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105226; rev:2;)
alert tcp $HOME_NET any -> 183.150.79.222 42629 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104529; rev:2;)
alert tcp $HOME_NET any -> 183.150.141.1 57127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103848; rev:2;)
alert tcp $HOME_NET any -> 183.150.205.192 57127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105225; rev:2;)
alert tcp $HOME_NET any -> 183.151.171.156 58331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103907; rev:2;)
alert tcp $HOME_NET any -> 183.151.174.249 60266 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106671; rev:2;)
alert tcp $HOME_NET any -> 183.153.114.172 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103847; rev:2;)
alert tcp $HOME_NET any -> 183.158.162.161 47195 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103846; rev:2;)
alert tcp $HOME_NET any -> 185.9.139.117 58178 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103845; rev:2;)
alert tcp $HOME_NET any -> 185.205.226.191 38313 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104782; rev:2;)
alert tcp $HOME_NET any -> 185.216.192.119 46639 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104987; rev:2;)
alert tcp $HOME_NET any -> 186.149.204.12 55148 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105699; rev:2;)
alert tcp $HOME_NET any -> 186.149.204.12 59384 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105745; rev:2;)
alert tcp $HOME_NET any -> 188.124.151.9 56677 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104779; rev:2;)
alert tcp $HOME_NET any -> 190.109.228.150 37896 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101885; rev:2;)
alert tcp $HOME_NET any -> 192.176.50.190 59653 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104774; rev:2;)
alert tcp $HOME_NET any -> 193.163.187.75 50459 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101907; rev:2;)
alert tcp $HOME_NET any -> 193.163.187.213 45749 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103723; rev:2;)
alert tcp $HOME_NET any -> 193.187.101.209 46746 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106488; rev:2;)
alert tcp $HOME_NET any -> 196.189.3.1 35468 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104131; rev:2;)
alert tcp $HOME_NET any -> 196.189.9.27 53134 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103906; rev:2;)
alert tcp $HOME_NET any -> 196.189.35.226 36957 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106137; rev:2;)
alert tcp $HOME_NET any -> 196.189.69.192 55987 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106670; rev:2;)
alert tcp $HOME_NET any -> 196.189.98.110 47834 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106144; rev:2;)
alert tcp $HOME_NET any -> 196.190.0.118 44669 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105833; rev:2;)
alert tcp $HOME_NET any -> 196.190.0.118 48753 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106487; rev:2;)
alert tcp $HOME_NET any -> 196.191.137.44 40459 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106014; rev:2;)
alert tcp $HOME_NET any -> 196.191.233.24 47579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106229; rev:2;)
alert tcp $HOME_NET any -> 198.58.186.53 52290 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105710; rev:2;)
alert tcp $HOME_NET any -> 199.16.59.198 57447 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104536; rev:2;)
alert tcp $HOME_NET any -> 200.115.102.16 53743 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106094; rev:2;)
alert tcp $HOME_NET any -> 201.110.154.77 39438 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106093; rev:2;)
alert tcp $HOME_NET any -> 202.1.26.13 41939 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105412; rev:2;)
alert tcp $HOME_NET any -> 202.1.26.70 41574 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105032; rev:2;)
alert tcp $HOME_NET any -> 202.163.107.242 56480 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104766; rev:2;)
alert tcp $HOME_NET any -> 203.101.187.5 45376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105744; rev:2;)
alert tcp $HOME_NET any -> 203.160.9.182 43948 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104758; rev:2;)
alert tcp $HOME_NET any -> 203.204.93.86 35425 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106669; rev:2;)
alert tcp $HOME_NET any -> 207.34.149.169 34385 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104756; rev:2;)
alert tcp $HOME_NET any -> 207.188.90.226 37720 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104266; rev:2;)
alert tcp $HOME_NET any -> 207.188.90.227 44244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104905; rev:2;)
alert tcp $HOME_NET any -> 209.81.111.104 55587 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105398; rev:2;)
alert tcp $HOME_NET any -> 210.208.104.156 37194 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105053; rev:2;)
alert tcp $HOME_NET any -> 210.208.106.68 38386 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105224; rev:2;)
alert tcp $HOME_NET any -> 210.208.106.68 47841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103768; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.4 37579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105223; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.4 43380 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103844; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.20 50244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105636; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.20 60482 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103767; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.21 35078 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105023; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.21 58400 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103766; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.42 48170 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101886; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.42 48479 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105024; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 41738 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101908; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 43845 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105594; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 55006 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106136; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.130 35632 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101909; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.130 43841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105222; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.147 49159 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101887; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.147 59877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105221; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.172 36904 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101910; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.172 46277 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106092; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.221 40213 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101911; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.221 56269 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104904; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.2 34156 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106135; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.2 48376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101912; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.26 33341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105220; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.26 49470 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101888; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.36 38915 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101889; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.36 50488 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105219; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.74 50244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105218; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.74 59088 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103843; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.100 46099 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101890; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.100 56274 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105217; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.220 37183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103765; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.220 50143 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105216; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.234 42818 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101891; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.234 49349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105593; rev:2;)
alert tcp $HOME_NET any -> 210.208.116.107 34736 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103754; rev:2;)
alert tcp $HOME_NET any -> 210.208.116.107 44471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104903; rev:2;)
alert tcp $HOME_NET any -> 210.212.30.46 34158 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105366; rev:2;)
alert tcp $HOME_NET any -> 210.212.30.170 60531 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105703; rev:2;)
alert tcp $HOME_NET any -> 210.212.31.178 41770 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104843; rev:2;)
alert tcp $HOME_NET any -> 216.126.86.93 35535 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106228; rev:2;)
alert tcp $HOME_NET any -> 216.126.86.154 38351 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104031; rev:2;)
alert tcp $HOME_NET any -> 216.129.184.213 55587 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104754; rev:2;)
alert tcp $HOME_NET any -> 218.28.151.239 60344 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105743; rev:2;)
alert tcp $HOME_NET any -> 218.58.146.50 57477 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104752; rev:2;)
alert tcp $HOME_NET any -> 218.72.34.168 44366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104130; rev:2;)
alert tcp $HOME_NET any -> 219.154.185.65 55284 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106668; rev:2;)
alert tcp $HOME_NET any -> 219.155.80.213 57148 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106486; rev:2;)
alert tcp $HOME_NET any -> 219.155.81.73 57148 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105215; rev:2;)
alert tcp $HOME_NET any -> 219.155.86.225 52134 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105052; rev:2;)
alert tcp $HOME_NET any -> 219.155.104.50 48910 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105709; rev:2;)
alert tcp $HOME_NET any -> 219.155.130.51 35600 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106485; rev:2;)
alert tcp $HOME_NET any -> 219.155.130.122 46869 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105051; rev:2;)
alert tcp $HOME_NET any -> 219.155.192.25 45843 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106214; rev:2;)
alert tcp $HOME_NET any -> 219.155.200.86 54365 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105708; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.95 50456 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105370; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.117 50456 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105050; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.136 36366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105214; rev:2;)
alert tcp $HOME_NET any -> 219.155.201.211 50456 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106667; rev:2;)
alert tcp $HOME_NET any -> 219.155.203.63 47994 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106666; rev:2;)
alert tcp $HOME_NET any -> 219.156.55.157 40201 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106774; rev:2;)
alert tcp $HOME_NET any -> 219.156.56.62 39663 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105832; rev:2;)
alert tcp $HOME_NET any -> 219.156.112.53 39981 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106125; rev:2;)
alert tcp $HOME_NET any -> 219.156.153.14 38441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106484; rev:2;)
alert tcp $HOME_NET any -> 219.156.181.248 55088 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105369; rev:2;)
alert tcp $HOME_NET any -> 219.157.16.109 59560 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105707; rev:2;)
alert tcp $HOME_NET any -> 219.157.18.29 33756 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105726; rev:2;)
alert tcp $HOME_NET any -> 219.157.63.126 54018 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105725; rev:2;)
alert tcp $HOME_NET any -> 219.157.63.238 58386 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105428; rev:2;)
alert tcp $HOME_NET any -> 219.157.161.10 60183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104902; rev:2;)
alert tcp $HOME_NET any -> 219.157.164.243 33354 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105465; rev:2;)
alert tcp $HOME_NET any -> 219.157.167.99 33777 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104129; rev:2;)
alert tcp $HOME_NET any -> 219.157.183.84 33148 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105368; rev:2;)
alert tcp $HOME_NET any -> 219.157.202.41 34653 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106665; rev:2;)
alert tcp $HOME_NET any -> 220.177.11.172 54471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104030; rev:2;)
alert tcp $HOME_NET any -> 220.202.90.41 58445 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106227; rev:2;)
alert tcp $HOME_NET any -> 221.1.226.106 47537 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105397; rev:2;)
alert tcp $HOME_NET any -> 221.1.226.194 52984 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104751; rev:2;)
alert tcp $HOME_NET any -> 221.3.87.188 42241 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106226; rev:2;)
alert tcp $HOME_NET any -> 221.13.232.22 35790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104750; rev:2;)
alert tcp $HOME_NET any -> 221.14.15.139 35706 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106091; rev:2;)
alert tcp $HOME_NET any -> 221.14.52.245 47598 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105025; rev:2;)
alert tcp $HOME_NET any -> 221.14.107.151 48123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106483; rev:2;)
alert tcp $HOME_NET any -> 221.14.168.213 54946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105049; rev:2;)
alert tcp $HOME_NET any -> 221.14.171.98 54946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105356; rev:2;)
alert tcp $HOME_NET any -> 221.14.174.125 44223 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106482; rev:2;)
alert tcp $HOME_NET any -> 221.14.174.131 54946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105706; rev:2;)
alert tcp $HOME_NET any -> 221.15.9.33 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105831; rev:2;)
alert tcp $HOME_NET any -> 221.15.9.134 32847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106481; rev:2;)
alert tcp $HOME_NET any -> 221.15.12.42 44703 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105705; rev:2;)
alert tcp $HOME_NET any -> 221.15.146.122 40487 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106752; rev:2;)
alert tcp $HOME_NET any -> 221.15.173.160 33401 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103764; rev:2;)
alert tcp $HOME_NET any -> 221.15.190.37 39478 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105446; rev:2;)
alert tcp $HOME_NET any -> 221.15.252.177 50496 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106225; rev:2;)
alert tcp $HOME_NET any -> 221.209.83.46 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106480; rev:2;)
alert tcp $HOME_NET any -> 222.127.48.44 47607 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104265; rev:2;)
alert tcp $HOME_NET any -> 222.127.54.84 59994 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104264; rev:2;)
alert tcp $HOME_NET any -> 222.127.63.230 37978 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104528; rev:2;)
alert tcp $HOME_NET any -> 222.127.68.115 42552 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101913; rev:2;)
alert tcp $HOME_NET any -> 222.127.73.15 41760 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106664; rev:2;)
alert tcp $HOME_NET any -> 222.127.76.16 52799 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104535; rev:2;)
alert tcp $HOME_NET any -> 222.127.77.227 56118 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105213; rev:2;)
alert tcp $HOME_NET any -> 222.127.77.227 56952 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104029; rev:2;)
alert tcp $HOME_NET any -> 222.127.154.221 58286 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105212; rev:2;)
alert tcp $HOME_NET any -> 222.127.156.105 38221 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106663; rev:2;)
alert tcp $HOME_NET any -> 222.127.243.18 35695 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106662; rev:2;)
alert tcp $HOME_NET any -> 222.127.248.61 60154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106090; rev:2;)
alert tcp $HOME_NET any -> 222.134.172.157 35193 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105742; rev:2;)
alert tcp $HOME_NET any -> 222.134.173.235 41659 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105704; rev:2;)
alert tcp $HOME_NET any -> 222.136.109.202 50366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106426; rev:2;)
alert tcp $HOME_NET any -> 222.137.132.141 37017 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103842; rev:2;)
alert tcp $HOME_NET any -> 222.137.145.114 43346 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105741; rev:2;)
alert tcp $HOME_NET any -> 222.137.175.220 33354 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105396; rev:2;)
alert tcp $HOME_NET any -> 222.137.208.37 35853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105419; rev:2;)
alert tcp $HOME_NET any -> 222.137.209.172 35853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105211; rev:2;)
alert tcp $HOME_NET any -> 222.137.210.1 35853 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106213; rev:2;)
alert tcp $HOME_NET any -> 222.137.235.158 37181 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105592; rev:2;)
alert tcp $HOME_NET any -> 222.138.213.176 34984 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105418; rev:2;)
alert tcp $HOME_NET any -> 222.139.34.67 44511 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105395; rev:2;)
alert tcp $HOME_NET any -> 222.139.36.162 57183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104745; rev:2;)
alert tcp $HOME_NET any -> 222.139.75.215 52350 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106479; rev:2;)
alert tcp $HOME_NET any -> 222.139.194.242 60965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106661; rev:2;)
alert tcp $HOME_NET any -> 222.140.180.172 33921 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105210; rev:2;)
alert tcp $HOME_NET any -> 222.140.183.127 55393 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105026; rev:2;)
alert tcp $HOME_NET any -> 222.141.122.247 41075 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104746; rev:2;)
alert tcp $HOME_NET any -> 222.142.207.37 51650 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105209; rev:2;)
alert tcp $HOME_NET any -> 222.142.208.152 36145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106224; rev:2;)
alert tcp $HOME_NET any -> 222.142.227.31 39111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105367; rev:2;)
alert tcp $HOME_NET any -> 222.142.240.141 56223 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106660; rev:2;)
alert tcp $HOME_NET any -> 222.142.241.107 48515 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106751; rev:2;)
alert tcp $HOME_NET any -> 222.142.244.43 36726 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105724; rev:2;)
alert tcp $HOME_NET any -> 222.142.245.72 36694 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105635; rev:2;)
alert tcp $HOME_NET any -> 222.142.253.114 60129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106089; rev:2;)
alert tcp $HOME_NET any -> 222.185.164.78 52993 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105048; rev:2;)
alert tcp $HOME_NET any -> 222.185.199.120 32826 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103649; rev:2;)
alert tcp $HOME_NET any -> 222.214.101.175 41596 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106750; rev:2;)
alert tcp $HOME_NET any -> 222.246.23.18 60522 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106088; rev:2;)
alert tcp $HOME_NET any -> 222.246.41.226 44313 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103841; rev:2;)
alert tcp $HOME_NET any -> 222.246.42.116 33992 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103722; rev:2;)
alert tcp $HOME_NET any -> 223.11.56.145 52220 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104263; rev:2;)
alert tcp $HOME_NET any -> 223.14.78.86 55197 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105591; rev:2;)