# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 133 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family overlord — https://publicmosaic.com/c2/overlord
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 2.24.131.42 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"55525ecfe3dbf0f32aa604efa8d73018d42b430574f29881cb3108d0fa545840"; reference:url,publicmosaic.com/indicators; sid:9101061; rev:2;)
alert tls $HOME_NET any -> 2.26.121.28 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"7dedbbbf061b961dad9912084e6063428bf8c4f0996c6a00400d6ce3f3de2ab4"; reference:url,publicmosaic.com/indicators; sid:9101060; rev:2;)
alert tls $HOME_NET any -> 2.26.124.191 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"a6892faf74c20765621cf08eeaf6e0a2dc6a3faf66df7ffdfda6d8153fddbd89"; reference:url,publicmosaic.com/indicators; sid:9103990; rev:2;)
alert tls $HOME_NET any -> 2.26.124.191 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"438d5b59c9c8956b511c1a6dab0476f34b1f7a7eecaf6b378fab51aee88235e5"; reference:url,publicmosaic.com/indicators; sid:9106574; rev:2;)
alert tls $HOME_NET any -> 2.27.13.58 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"7205724774b03e2a6b09fac24e063cffe4bf3e945406690a32e58fa0b5028d71"; reference:url,publicmosaic.com/indicators; sid:9104285; rev:2;)
alert tls $HOME_NET any -> 2.27.200.141 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"f04c69cf8c0809cb45e96cd28d6e97039343b2f8758d6b9603605c91024ffa50"; reference:url,publicmosaic.com/indicators; sid:9101063; rev:2;)
alert tls $HOME_NET any -> 2.27.200.141 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"11ff89d8b4c2b02d0cd303a6b54bdf29dcc5b3d50d287436f7ebf74b97d4f3b4"; reference:url,publicmosaic.com/indicators; sid:9101064; rev:2;)
alert tls $HOME_NET any -> 2.58.56.157 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"22ce87cfa0affc1ef73feec4b7eb6ef708b6e412b2faebd11f3d2a4d4b68368d"; reference:url,publicmosaic.com/indicators; sid:9103835; rev:2;)
alert tls $HOME_NET any -> 5.56.25.71 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"6b4af3b8ef8e453c1988e8e5c6c07e6ea31254d43832d5123177fb724399b98f"; reference:url,publicmosaic.com/indicators; sid:9102083; rev:2;)
alert tls $HOME_NET any -> 5.255.114.98 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"2d527994f8fc945ea63abc278ae6e8cd3489c6559f779f86ac36201c744d58b7"; reference:url,publicmosaic.com/indicators; sid:9102082; rev:2;)
alert tls $HOME_NET any -> 23.95.17.118 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"483359bdd5c36f0bab98ac162b180326c98d9d4bfc160aa952e6189228f4622c"; reference:url,publicmosaic.com/indicators; sid:9102081; rev:2;)
alert tls $HOME_NET any -> 23.95.227.13 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"1079398ab73621301156032f1e0db7ec2e7c2be7c0294eb2d3e8ce5ed03208d2"; reference:url,publicmosaic.com/indicators; sid:9101062; rev:2;)
alert tls $HOME_NET any -> 31.76.110.14 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5ee4961904bc3206b2368d1e01a8888a819cf1c1757e6b874d88689e350aec02"; reference:url,publicmosaic.com/indicators; sid:9104284; rev:2;)
alert tcp $HOME_NET any -> 31.77.78.18 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9103655; rev:2;)
alert tcp $HOME_NET any -> 34.116.213.177 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9102080; rev:2;)
alert tls $HOME_NET any -> 45.38.20.110 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"2082bb589821e6d5672fbf5a5b72dc3dadc67edce303a6e7479f9b12b4a4f7ff"; reference:url,publicmosaic.com/indicators; sid:9105124; rev:2;)
alert tls $HOME_NET any -> 45.61.176.17 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"9723ae3a204ab2a51e8e6376f1ae327e9a5dc26c6912dcb5d074b2b339f6ca13"; reference:url,publicmosaic.com/indicators; sid:9102079; rev:2;)
alert tls $HOME_NET any -> 45.67.138.152 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"4bba3f69eafed7cb2644ee2b28621f3933c2fbc72a0ab368783c6efb6b658c5d"; reference:url,publicmosaic.com/indicators; sid:9105123; rev:2;)
alert tls $HOME_NET any -> 45.76.255.56 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5e5236a26f1dc69d0c0d3b44f104ef30c3b8934b80022e9086fa07f72975eae6"; reference:url,publicmosaic.com/indicators; sid:9103834; rev:2;)
alert tls $HOME_NET any -> 45.77.108.203 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"4b45b2772058ee9714d563872df4eff923f3e55b702bf1eb2291c5cc5b4cf3e6"; reference:url,publicmosaic.com/indicators; sid:9102078; rev:2;)
alert tcp $HOME_NET any -> 45.94.31.227 80 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9101709; rev:2;)
alert tls $HOME_NET any -> 45.94.31.227 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"514887edd38662a3fcfe717d04e0c688e5dde95c618f572c7d6b2845c618c38a"; reference:url,publicmosaic.com/indicators; sid:9101589; rev:2;)
alert tls $HOME_NET any -> 45.156.87.201 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"fb5deb94374ee16c4f8dda151ccc141bdb0834cb0683d110b7e2682470a84b1b"; reference:url,publicmosaic.com/indicators; sid:9102077; rev:2;)
alert tls $HOME_NET any -> 45.192.12.44 1337 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"177689ea7c6c2f4f86cbd85699bf49118762cd810115684890d1a4041e79fa81"; reference:url,publicmosaic.com/indicators; sid:9104283; rev:2;)
alert tls $HOME_NET any -> 46.151.182.224 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"2efaa44a207ed4b8be55569ed079e3971cc1216e60536fd8f69f18a5e9aa2c7c"; reference:url,publicmosaic.com/indicators; sid:9102076; rev:2;)
alert tls $HOME_NET any -> 51.161.9.215 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"4b0d1474b21b19bdd9c469db5c5ef7efa318b88b527ca02bf7c77f52d317314c"; reference:url,publicmosaic.com/indicators; sid:9102075; rev:2;)
alert tls $HOME_NET any -> 51.195.202.236 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"351b887f8898691261c932799d0de10c0b338ba39dd0b67e7a63354cfb316389"; reference:url,publicmosaic.com/indicators; sid:9102074; rev:2;)
alert tcp $HOME_NET any -> 57.129.119.130 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9102073; rev:2;)
alert tls $HOME_NET any -> 64.89.161.6 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"00da4000e5ab4cd9a7ed63311ed45600e5c176a06799ce8683c55879a74edbb0"; reference:url,publicmosaic.com/indicators; sid:9102072; rev:2;)
alert tls $HOME_NET any -> 64.89.161.171 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"b7a8bbffdcd03b9c62f0c0de10a44102d262ce72c25968f916aecdbb1deb5967"; reference:url,publicmosaic.com/indicators; sid:9106573; rev:2;)
alert tls $HOME_NET any -> 65.87.7.167 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5fbcd3f53010fa0b19ea6c60f99ad1d821be08e59d9bbc8b346eaa3cc0938da9"; reference:url,publicmosaic.com/indicators; sid:9102070; rev:2;)
alert tls $HOME_NET any -> 66.42.92.155 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c47da250758565995349bf1b011e4443f1072470dbcb695daa9e4670cbe6a4ab"; reference:url,publicmosaic.com/indicators; sid:9102069; rev:2;)
alert tls $HOME_NET any -> 66.78.40.24 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"178f5860b3659d634d2f3c2b7273b8e7ac096e958bf2127f96d87c873b1cf450"; reference:url,publicmosaic.com/indicators; sid:9102068; rev:2;)
alert tls $HOME_NET any -> 74.208.92.197 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"83ed42f8d648efe3c188f76d5f7368f8634a012d86f4d15d0a04783c80fc70f9"; reference:url,publicmosaic.com/indicators; sid:9102067; rev:2;)
alert tls $HOME_NET any -> 74.208.159.74 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c132d24fe560736545a48b2d83d350d96aa47589a325abf07ff730584355e837"; reference:url,publicmosaic.com/indicators; sid:9102066; rev:2;)
alert tls $HOME_NET any -> 80.85.146.244 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c0c1a954a67ddbbab622c8fa00f8e99b454cbe5d92c03a3a692c92757fe75c1e"; reference:url,publicmosaic.com/indicators; sid:9101052; rev:2;)
alert tcp $HOME_NET any -> 80.85.146.244 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9101053; rev:2;)
alert tls $HOME_NET any -> 83.147.192.25 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"b5f6b9488429414f258c932f3be19aaef406e6814f90ad48017fb0ca0c5b7e69"; reference:url,publicmosaic.com/indicators; sid:9105099; rev:2;)
alert tls $HOME_NET any -> 85.11.167.86 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ba7ce4eb2fa4516547f72fa7e1242559141163a9c4c205cf53ea33d5713e6689"; reference:url,publicmosaic.com/indicators; sid:9106124; rev:2;)
alert tls $HOME_NET any -> 87.106.5.187 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"884f2c32c19994898ce06be4a7fd0decaa08a7ced90070e93a958b0bccc7b26a"; reference:url,publicmosaic.com/indicators; sid:9104103; rev:2;)
alert tcp $HOME_NET any -> 87.120.104.17 80 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9106475; rev:2;)
alert tls $HOME_NET any -> 87.120.104.210 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"0daab729647f0da52e24b404cd2e2edb0a4a367da7bf1e0699d89258b641d992"; reference:url,publicmosaic.com/indicators; sid:9103637; rev:2;)
alert tls $HOME_NET any -> 88.87.85.199 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c9f58a2c52e7c8948f66286d4ee383f4d405cbb5a8bf445faa5036f8cf479e61"; reference:url,publicmosaic.com/indicators; sid:9101050; rev:2;)
alert tls $HOME_NET any -> 88.87.85.199 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"964bd84a390c4d49f29ddf9e8caead255977401ba5869b475c3147935f3d9ff8"; reference:url,publicmosaic.com/indicators; sid:9101049; rev:2;)
alert tls $HOME_NET any -> 89.125.255.29 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"84c784771d4f90ad8268f1f94459099887f8a1dd8a97cf58d72b79073a93831c"; reference:url,publicmosaic.com/indicators; sid:9102065; rev:2;)
alert tls $HOME_NET any -> 91.92.40.92 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"280e81398faa91b2223ad6ba6afc474e433f649fe6a3cf7c42c95c66a2ae6522"; reference:url,publicmosaic.com/indicators; sid:9104102; rev:2;)
alert tls $HOME_NET any -> 91.196.162.234 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"a230a74ceaf81a6e34c689a0f3896e6b2393606f61e36fd1d3547ab56e508089"; reference:url,publicmosaic.com/indicators; sid:9102064; rev:2;)
alert tls $HOME_NET any -> 91.208.162.174 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"d88cdad0989a562456ce0d91ff2dd04e221a8189d14e09fa18ffcc2f0b5f4a2e"; reference:url,publicmosaic.com/indicators; sid:9102063; rev:2;)
alert tls $HOME_NET any -> 91.208.206.83 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"7cb50cd8ae255c253692f5bec6dd50c681dd434d433252532a97581b92fe3e41"; reference:url,publicmosaic.com/indicators; sid:9101048; rev:2;)
alert tls $HOME_NET any -> 92.112.127.220 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c3060c79971b118bb3051917a14f0a5722f469b0df6cb10137fde214a8a02019"; reference:url,publicmosaic.com/indicators; sid:9104934; rev:2;)
alert tls $HOME_NET any -> 92.119.165.26 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5a75d6ffec6d53431a9db918ea2888fd3e27c1d7ee1cb2bd3433c592ae8ab4b5"; reference:url,publicmosaic.com/indicators; sid:9102062; rev:2;)
alert tls $HOME_NET any -> 92.119.165.26 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ac2f81a77ed9f7de8483c4f7d1c9681ed4fe8bb86172ea3a2fbc967da2c5b6d2"; reference:url,publicmosaic.com/indicators; sid:9102061; rev:2;)
alert tls $HOME_NET any -> 93.152.224.18 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"3e9e34658526e6e50560657c58ef244652ff6040c7ea6ff6bd4b57874111761d"; reference:url,publicmosaic.com/indicators; sid:9101043; rev:2;)
alert tcp $HOME_NET any -> 94.249.230.167 80 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9101045; rev:2;)
alert tls $HOME_NET any -> 94.249.230.167 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e47b32606f57891347efd88dff4c00fe2ee25ea2e6607f77fb1fb097d4d4669b"; reference:url,publicmosaic.com/indicators; sid:9101044; rev:2;)
alert tls $HOME_NET any -> 95.179.214.252 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e238b0ffde92c913be7d3356f15d3b27e43a9b936ef83e31ccf3c3ad0663c8fe"; reference:url,publicmosaic.com/indicators; sid:9102060; rev:2;)
alert tls $HOME_NET any -> 103.43.71.150 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"a09fe10cb0c5651b97d32b5b3064e2f3480faf5d8589ea82dde3418169902a57"; reference:url,publicmosaic.com/indicators; sid:9106132; rev:2;)
alert tls $HOME_NET any -> 103.229.53.84 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5ddae6f30ac64ad4b08e572b1ae2598deba915c4c6353a0f9f690f729f2aa6d0"; reference:url,publicmosaic.com/indicators; sid:9102059; rev:2;)
alert tls $HOME_NET any -> 104.129.12.113 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"0dced88d0f04227def6817c0f370d7fad957d5ec5225fb51be1545c3fc6508b4"; reference:url,publicmosaic.com/indicators; sid:9101041; rev:2;)
alert tls $HOME_NET any -> 107.150.72.132 5174 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"cbb51a4df88801816b3529e6e193edae65790ed811ae23540a3d5ecf69529ca3"; reference:url,publicmosaic.com/indicators; sid:9102058; rev:2;)
alert tls $HOME_NET any -> 107.175.115.123 8443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"3319c0ee354cd19566a2d71f6d568de3bf0ec0e31b7f183946166db2ee17f0c7"; reference:url,publicmosaic.com/indicators; sid:9101536; rev:2;)
alert tls $HOME_NET any -> 109.123.227.28 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"86a8eb7902099ab7a10764b6a3ede51a5113473abc06a72e11181d6dcfd59e99"; reference:url,publicmosaic.com/indicators; sid:9102057; rev:2;)
alert tls $HOME_NET any -> 137.184.56.42 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"75a7d9f2b0c4145da8572961218e79e0d24c09d2da45a60884902c2fe91e6e0c"; reference:url,publicmosaic.com/indicators; sid:9105859; rev:2;)
alert tls $HOME_NET any -> 137.220.51.205 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"f357051507c6c161eccbd6907de95eef24073718a6ef5f9f9f73243c51af8c1e"; reference:url,publicmosaic.com/indicators; sid:9102056; rev:2;)
alert tls $HOME_NET any -> 138.2.159.134 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"7643e1a93b6ef0952f0573c5e1e3237ca4f0770a1a558f659fe9ce6ccc4d7781"; reference:url,publicmosaic.com/indicators; sid:9101042; rev:2;)
alert tls $HOME_NET any -> 138.16.177.250 8080 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"b4334e7d5c5a3fbd6d3d33e958c88c6e300e3930cb463f7927caded1ada5f661"; reference:url,publicmosaic.com/indicators; sid:9101040; rev:2;)
alert tls $HOME_NET any -> 138.197.84.20 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"d3f2da36a441c1ccd110229223a7720e00f6d7e76525ea8cb0ceae494181f362"; reference:url,publicmosaic.com/indicators; sid:9102055; rev:2;)
alert tls $HOME_NET any -> 138.197.84.20 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"02da795080fc01af4a0f00adc248383be13a5d1b93d1273fe7b5abf6523e573d"; reference:url,publicmosaic.com/indicators; sid:9102054; rev:2;)
alert tls $HOME_NET any -> 141.94.145.72 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ac38c8e70b7f623abe06fe913758bc3ff4698bb31712fceafdb87c56b224cbf6"; reference:url,publicmosaic.com/indicators; sid:9102053; rev:2;)
alert tls $HOME_NET any -> 142.93.4.32 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"026a31ce9814d84572a719b544ca3cdccf75ac9bd3d991184483e9c36ad9b4c6"; reference:url,publicmosaic.com/indicators; sid:9101039; rev:2;)
alert tls $HOME_NET any -> 143.92.57.247 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"18df181867422ea6dd581969bdf5cc9563d436a79473a18c661c8ae13402a41d"; reference:url,publicmosaic.com/indicators; sid:9106572; rev:2;)
alert tls $HOME_NET any -> 143.246.221.122 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8fd19ec273187b33decfa290c48953dd1f2a09e6d38f261c3ffe246fd039ade0"; reference:url,publicmosaic.com/indicators; sid:9106391; rev:2;)
alert tls $HOME_NET any -> 146.19.125.151 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"760ff351b2ad8929fee82d3f7dde81d886919311de173984bed30bc1d2f9d377"; reference:url,publicmosaic.com/indicators; sid:9102052; rev:2;)
alert tls $HOME_NET any -> 146.190.215.221 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"03ed728076d2fa72d04a4e7e3fe0b3d3fb47de63f50c37ce9d9e0b653b5a073b"; reference:url,publicmosaic.com/indicators; sid:9102051; rev:2;)
alert tls $HOME_NET any -> 147.45.68.246 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8b269313c3decae7a6ca7095082bdbf862cc92f46adb553978bc3c630f73733b"; reference:url,publicmosaic.com/indicators; sid:9102050; rev:2;)
alert tls $HOME_NET any -> 147.90.182.27 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"b92bb82b63a416c72fa47fe013b63b1d6382afefb2f5412fe36001cf7c9ee44c"; reference:url,publicmosaic.com/indicators; sid:9104101; rev:2;)
alert tls $HOME_NET any -> 149.50.97.235 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"49b953c98f3a4e3eeb65851a0383ad6dddd4455418133e6e469a9b59db08e373"; reference:url,publicmosaic.com/indicators; sid:9102049; rev:2;)
alert tls $HOME_NET any -> 150.40.117.165 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"23a85b9886d8b19feead09ceb54b5c85d33477a3bf253315db5d9023ccb97356"; reference:url,publicmosaic.com/indicators; sid:9102048; rev:2;)
alert tls $HOME_NET any -> 150.241.124.167 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"6e5a6df9089e08af5454e9bda84fb60b951825f1928ec60bd33569d0e571be3a"; reference:url,publicmosaic.com/indicators; sid:9104933; rev:2;)
alert tls $HOME_NET any -> 151.243.219.138 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"6de00052026e5a9ae43df85013d9f8a5ff832cfc8a68672335c4d21ee618f015"; reference:url,publicmosaic.com/indicators; sid:9102047; rev:2;)
alert tls $HOME_NET any -> 157.230.125.59 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"fa909f0fc85d2138813d9c0599c4c7431de68cc89e7d7535132223d29e6956bc"; reference:url,publicmosaic.com/indicators; sid:9102046; rev:2;)
alert tls $HOME_NET any -> 158.220.101.234 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"62b770a71ab9fe547ffdeebab88538b06d708b01331f0f0a33c5d9aa6fd0e800"; reference:url,publicmosaic.com/indicators; sid:9103833; rev:2;)
alert tls $HOME_NET any -> 161.35.124.206 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"fbd2953d419ae388a89a4ef48ae01dbdb382f2360383b94bc4f0fc76eec34db1"; reference:url,publicmosaic.com/indicators; sid:9102045; rev:2;)
alert tcp $HOME_NET any -> 161.97.89.221 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9102044; rev:2;)
alert tls $HOME_NET any -> 163.61.183.95 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"be7a5af702d7ea8a73cf3de3fcb95bec7d3c2cb9585564a295e5ba46015f802f"; reference:url,publicmosaic.com/indicators; sid:9102043; rev:2;)
alert tls $HOME_NET any -> 165.22.111.25 2087 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5970ea73193c28a338c7d0ad07f8e8b14824c038dc4a95234f0aaf20a0241949"; reference:url,publicmosaic.com/indicators; sid:9102042; rev:2;)
alert tls $HOME_NET any -> 165.227.87.199 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"19c4ecab951fcc5a1e477e4ad9e5623291d2e21e402b3503037e66ae84cd9343"; reference:url,publicmosaic.com/indicators; sid:9103989; rev:2;)
alert tls $HOME_NET any -> 167.71.242.108 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"67a37dc64686fa7ab3816951b7b02ec91c39afc46cf0cb89501ef070957bd57b"; reference:url,publicmosaic.com/indicators; sid:9101034; rev:2;)
alert tls $HOME_NET any -> 169.58.112.87 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"72aa947b6e0d49d24fea23877edd19d2e8bd395f8ac772bda5b651283dc98732"; reference:url,publicmosaic.com/indicators; sid:9102041; rev:2;)
alert tls $HOME_NET any -> 170.64.229.96 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"25b8cf1e97940f47718afc7652c5bc6d6cd14133bb4278aecf70375f127930f4"; reference:url,publicmosaic.com/indicators; sid:9102040; rev:2;)
alert tls $HOME_NET any -> 172.96.137.123 5223 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"2080b032ed59cb3a0ec03e0db5b5201ae38bed93c74bf1637183de48dc44b0eb"; reference:url,publicmosaic.com/indicators; sid:9102039; rev:2;)
alert tls $HOME_NET any -> 172.237.72.64 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"bfb2b2fe4f09f57e09bb40bccbdffda812cb9d1cc6baf10110e8fd7efc68324e"; reference:url,publicmosaic.com/indicators; sid:9102038; rev:2;)
alert tls $HOME_NET any -> 178.62.74.147 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"31acf84cff5f9756862a943dbbe7a7243b2429283810fc8bd8c30049bd4fbe91"; reference:url,publicmosaic.com/indicators; sid:9105857; rev:2;)
alert tcp $HOME_NET any -> 179.43.175.47 80 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9101035; rev:2;)
alert tls $HOME_NET any -> 179.43.175.47 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"97944a0809d78a022c571619d65a2595886555c0f043104b9b85fdd5e321fadf"; reference:url,publicmosaic.com/indicators; sid:9101032; rev:2;)
alert tcp $HOME_NET any -> 179.43.175.48 80 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9101031; rev:2;)
alert tls $HOME_NET any -> 179.43.175.48 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"97944a0809d78a022c571619d65a2595886555c0f043104b9b85fdd5e321fadf"; reference:url,publicmosaic.com/indicators; sid:9101029; rev:2;)
alert tls $HOME_NET any -> 185.177.239.246 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ee20bfdc9db1eaa03fa109a3da5398c9ada2f3562ef3f0c97ad7168d6f8b8a1b"; reference:url,publicmosaic.com/indicators; sid:9102037; rev:2;)
alert tls $HOME_NET any -> 185.238.191.45 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5b739d53e698aa14be29b145b0cd9b5091848ae1980d70fd17dc283e255963c5"; reference:url,publicmosaic.com/indicators; sid:9105856; rev:2;)
alert tls $HOME_NET any -> 185.242.235.16 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"be412d387830e7567a52444060ccee08ca5f91c12740e92c242a1d72a8b100c2"; reference:url,publicmosaic.com/indicators; sid:9102036; rev:2;)
alert tls $HOME_NET any -> 191.96.78.230 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"2bf91ddc66f08e0d02aba0f2800d529be9197037918b43f93c37ad03932b3bcb"; reference:url,publicmosaic.com/indicators; sid:9102035; rev:2;)
alert tls $HOME_NET any -> 191.96.79.40 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"bea01266923091b7aa4412e2863a3312eb94142dd3b78ca44323176b7b8ee3d2"; reference:url,publicmosaic.com/indicators; sid:9102034; rev:2;)
alert tls $HOME_NET any -> 191.96.225.70 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"1d2d606e319cf98db5ae0964cbd455010448b701bdc3c633b947c9a57117e849"; reference:url,publicmosaic.com/indicators; sid:9102033; rev:2;)
alert tls $HOME_NET any -> 191.96.225.125 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c4d9813ae8aad5d5c530580e1e50be88e30886f9fdbb2a61d5b107206ae9e041"; reference:url,publicmosaic.com/indicators; sid:9102032; rev:2;)
alert tls $HOME_NET any -> 191.101.131.147 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"fee727bcb5baae98be042437733205a367c2884d8425a792eaed6f89348b496c"; reference:url,publicmosaic.com/indicators; sid:9106007; rev:2;)
alert tls $HOME_NET any -> 192.210.150.212 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"de69393340667265b804ecabc46abe39971c940d884a9dff80ff9ff4a22a6f8b"; reference:url,publicmosaic.com/indicators; sid:9102031; rev:2;)
alert tcp $HOME_NET any -> 192.227.221.43 80 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9101026; rev:2;)
alert tls $HOME_NET any -> 192.227.221.43 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ec6b6a69c3ea0cea7d2652e5cbc7823820af5699f1d2c80b1a91fae854fe7071"; reference:url,publicmosaic.com/indicators; sid:9101025; rev:2;)
alert tls $HOME_NET any -> 192.227.221.43 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ec6b6a69c3ea0cea7d2652e5cbc7823820af5699f1d2c80b1a91fae854fe7071"; reference:url,publicmosaic.com/indicators; sid:9101030; rev:2;)
alert tls $HOME_NET any -> 192.229.81.71 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"28391145886ce1fc25967d138692786d75b7ed8dcd91af02182e6ac1a768a18e"; reference:url,publicmosaic.com/indicators; sid:9102030; rev:2;)
alert tls $HOME_NET any -> 193.181.213.156 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"4d882e088bf4b0a6da90fa66492dc2adb51ab548700aec06546cdda8f881f61e"; reference:url,publicmosaic.com/indicators; sid:9101024; rev:2;)
alert tls $HOME_NET any -> 193.188.21.234 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"54f761d2883d7479d88fb8e12196c4111c4b7ce4c00c7e1c09794cf1ece5bddc"; reference:url,publicmosaic.com/indicators; sid:9102029; rev:2;)
alert tls $HOME_NET any -> 193.233.90.128 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"d0e7e3e454017de449c3edaf63f53ca09e4a343307278df5eb471b1cc803e5b1"; reference:url,publicmosaic.com/indicators; sid:9102028; rev:2;)
alert tls $HOME_NET any -> 194.59.30.4 80 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106571; rev:2;)
alert tls $HOME_NET any -> 194.59.30.4 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106570; rev:2;)
alert tls $HOME_NET any -> 194.59.30.4 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106569; rev:2;)
alert tls $HOME_NET any -> 194.59.30.58 80 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9104100; rev:2;)
alert tls $HOME_NET any -> 194.59.30.58 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9102027; rev:2;)
alert tls $HOME_NET any -> 194.59.30.58 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8f70bf73b4bae08c2f1f56877ebe9b252a8fbbe0deb4d3e7fdea5191e485a6be"; reference:url,publicmosaic.com/indicators; sid:9106087; rev:2;)
alert tls $HOME_NET any -> 194.59.31.108 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"10c613ff05a07b01b6da7e21a96584418ddebfcc3e2cf7ead65a395f089c4910"; reference:url,publicmosaic.com/indicators; sid:9104516; rev:2;)
alert tcp $HOME_NET any -> 194.61.53.23 5173 (msg:"HOLLOWPOINT C2 overlord"; reference:url,publicmosaic.com/indicators; sid:9102026; rev:2;)
alert tls $HOME_NET any -> 196.251.107.43 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"46608c8419607d25dd0c0190e2ec2560e38e9b6f5f404277f4eaadfac23ecad3"; reference:url,publicmosaic.com/indicators; sid:9103652; rev:2;)
alert tls $HOME_NET any -> 196.251.107.112 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"8d3cd5f7fd9b9eb6b3ff9e65f69857df3f01dc30dadf73862183ce0ab0600153"; reference:url,publicmosaic.com/indicators; sid:9102025; rev:2;)
alert tls $HOME_NET any -> 196.251.107.131 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"cbce50b340c002a12df701514d34aab7513ce703e61a90d955c6e24503891d0e"; reference:url,publicmosaic.com/indicators; sid:9102084; rev:2;)
alert tls $HOME_NET any -> 198.23.177.203 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e52875259537dc47b1bda26a02b5ad15f2a7eb0adf77a619d63b5fab91f557c2"; reference:url,publicmosaic.com/indicators; sid:9102024; rev:2;)
alert tls $HOME_NET any -> 198.23.177.203 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e52875259537dc47b1bda26a02b5ad15f2a7eb0adf77a619d63b5fab91f557c2"; reference:url,publicmosaic.com/indicators; sid:9102023; rev:2;)
alert tls $HOME_NET any -> 202.162.109.5 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"18df181867422ea6dd581969bdf5cc9563d436a79473a18c661c8ae13402a41d"; reference:url,publicmosaic.com/indicators; sid:9106568; rev:2;)
alert tls $HOME_NET any -> 202.162.109.6 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"18df181867422ea6dd581969bdf5cc9563d436a79473a18c661c8ae13402a41d"; reference:url,publicmosaic.com/indicators; sid:9106567; rev:2;)
alert tls $HOME_NET any -> 216.128.142.66 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"cfacb87ffd6c51424ee84489791fdf078df9cb5ac2821cdc251a0103eaf564c2"; reference:url,publicmosaic.com/indicators; sid:9106566; rev:2;)
alert tls $HOME_NET any -> 216.144.228.135 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"063ccb1e607e77f787ae609539c016f8008b3c299ef3804ad7375fcb252aa7a9"; reference:url,publicmosaic.com/indicators; sid:9102022; rev:2;)
alert tls $HOME_NET any -> 216.250.126.45 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"fdb01a533488fa38190dfbced69116b00e835a62e13487e987973238d3e11be4"; reference:url,publicmosaic.com/indicators; sid:9102021; rev:2;)
alert tls $HOME_NET any -> 217.60.77.60 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"5fc70cd955b398a9f170b91c068ed81221c864491110cc463aee27b72e9bbf94"; reference:url,publicmosaic.com/indicators; sid:9106799; rev:2;)
alert tls $HOME_NET any -> 217.60.77.63 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"e9bb5ceb9f231ce6b151e9b8f60bb520dfb3aa761a5e9e24b9fde139259082ef"; reference:url,publicmosaic.com/indicators; sid:9106798; rev:2;)