# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 147 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family quasar-rat — https://publicmosaic.com/c2/quasar-rat
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 1.14.46.205 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9102275; rev:2;)
alert tls $HOME_NET any -> 2.27.244.169 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f0e5edb6efbde650b993cab0d9abf392a6d7cbd0ab1c27544fefb38038fedaa2"; reference:url,publicmosaic.com/indicators; sid:9101301; rev:2;)
alert tls $HOME_NET any -> 2.59.133.71 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"563996cb95528b9bd43114dfa9aa74eace626a1e6e88c0ae14f301731c43c27d"; reference:url,publicmosaic.com/indicators; sid:9100809; rev:2;)
alert tcp $HOME_NET any -> 3.31.209.215 443 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106827; rev:2;)
alert tls $HOME_NET any -> 5.63.21.212 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"6b8ae04b3274e9b29423b01c2eba682c0fa50685c9b2d77504e4252abcbc0770"; reference:url,publicmosaic.com/indicators; sid:9102274; rev:2;)
alert tls $HOME_NET any -> 8.148.185.15 3347 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"67914470cb3e73c3fcaed423fbc56b3ed19f92a317e8ed8f1faf3ec416b6ede3"; reference:url,publicmosaic.com/indicators; sid:9104486; rev:2;)
alert tcp $HOME_NET any -> 13.143.139.233 7777 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106652; rev:2;)
alert tcp $HOME_NET any -> 20.218.121.193 4449 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106561; rev:2;)
alert tcp $HOME_NET any -> 20.218.121.193 8080 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106471; rev:2;)
alert tcp $HOME_NET any -> 20.245.10.22 27015 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106807; rev:2;)
alert tls $HOME_NET any -> 27.10.61.55 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5edc16157c7b887458b353f4da358633f3e4399c6c112f2656e6af03f5b974f1"; reference:url,publicmosaic.com/indicators; sid:9100060; rev:2;)
alert tls $HOME_NET any -> 27.50.29.181 5787 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"4b18b21245e49bb46583277e4bb823cd80d0dd3cb78f1fcc7ca962746dd34a60"; reference:url,publicmosaic.com/indicators; sid:9104114; rev:2;)
alert tls $HOME_NET any -> 31.59.118.75 5599 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"99fa81943895e707cbc56ae5f79a6f57d37a9173eb5ee12465cad2fa965501a9"; reference:url,publicmosaic.com/indicators; sid:9102273; rev:2;)
alert tls $HOME_NET any -> 35.86.129.120 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e35a96eb760cf019d619e0c91a5b66701ced08067225d907aaf9eb550c7637b0"; reference:url,publicmosaic.com/indicators; sid:9100428; rev:2;)
alert tls $HOME_NET any -> 37.72.168.240 80 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c609d756e318d950ed824105bd3644fffe57f4d4aa66af8380bc1c84e95d529a"; reference:url,publicmosaic.com/indicators; sid:9102272; rev:2;)
alert tcp $HOME_NET any -> 37.114.46.118 8808 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106470; rev:2;)
alert tls $HOME_NET any -> 38.54.94.117 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"0093bb4742c23ac2a8c170cc35508acbd8c876a60c174d2adb76604916f4af4c"; reference:url,publicmosaic.com/indicators; sid:9104154; rev:2;)
alert tls $HOME_NET any -> 38.54.94.117 4783 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"0093bb4742c23ac2a8c170cc35508acbd8c876a60c174d2adb76604916f4af4c"; reference:url,publicmosaic.com/indicators; sid:9105540; rev:2;)
alert tls $HOME_NET any -> 38.92.47.25 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"fc37d9a011db5a6c9d431e0b2424fb0c92f764ae9f54d93732966900f501e663"; reference:url,publicmosaic.com/indicators; sid:9100812; rev:2;)
alert tls $HOME_NET any -> 39.99.237.255 1433 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8c52b7e4d0dd6952fdb9df975065242f20d86f51bfae45a7c5a5fc2cfef803e2"; reference:url,publicmosaic.com/indicators; sid:9100153; rev:2;)
alert tls $HOME_NET any -> 41.234.4.41 1339 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"20938282111b19b7d7b551895c66ddde7d630e82732ed0c71e30f4975e54ea9d"; reference:url,publicmosaic.com/indicators; sid:9104446; rev:2;)
alert tls $HOME_NET any -> 42.193.188.121 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9102271; rev:2;)
alert tcp $HOME_NET any -> 43.169.13.161 8081 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106824; rev:2;)
alert tls $HOME_NET any -> 45.43.163.233 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"2f9df3c7403943acb151e14f40ec760c51f9cda3064356c557ebd0ab9d286c65"; reference:url,publicmosaic.com/indicators; sid:9102270; rev:2;)
alert tls $HOME_NET any -> 45.61.170.158 8080 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"cd6a810faeb5fc5817d3ecfd176bf3814ca6a35b94d2450247b0cb7dd2eecc6c"; reference:url,publicmosaic.com/indicators; sid:9104149; rev:2;)
alert tls $HOME_NET any -> 45.61.177.22 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"6320ddfcb78fce946d74bd9c4d8ababeeded747bb256f7078690864dd2b26eec"; reference:url,publicmosaic.com/indicators; sid:9102269; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 4445 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"bbaea640195bdd22b89e6e382480d2cc2ae53fd3b5d68cc5f9f2a1546721bea5"; reference:url,publicmosaic.com/indicators; sid:9102268; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 4449 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e73036c4ab2298c5969fad2641bdbd73ff31b1746f50050a6c35975f53d9f807"; reference:url,publicmosaic.com/indicators; sid:9102267; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 7000 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f1303512bcd97a7f418cd04141581170750b5714d5db193d497e9db305696a82"; reference:url,publicmosaic.com/indicators; sid:9100144; rev:2;)
alert tls $HOME_NET any -> 45.63.43.183 8080 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8bab38b83f330a38b03dd9c016ee342ac57e1c08f4b7edc1bf74caaf1024b3bb"; reference:url,publicmosaic.com/indicators; sid:9100143; rev:2;)
alert tcp $HOME_NET any -> 45.84.1.14 9999 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106811; rev:2;)
alert tls $HOME_NET any -> 45.130.146.22 50050 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"ca8898610b0790ff85d01a465c1f96fc6549560748b4084717ff95c08f851ace"; reference:url,publicmosaic.com/indicators; sid:9100051; rev:2;)
alert tls $HOME_NET any -> 45.141.26.73 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"72fa846dfa62d63c3b6bb78c8c63cc78ec1e2667b8904f325c8f2189a571aeeb"; reference:url,publicmosaic.com/indicators; sid:9105098; rev:2;)
alert tcp $HOME_NET any -> 46.235.168.58 50050 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106812; rev:2;)
alert tls $HOME_NET any -> 47.99.65.37 8043 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c609d756e318d950ed824105bd3644fffe57f4d4aa66af8380bc1c84e95d529a"; reference:url,publicmosaic.com/indicators; sid:9104153; rev:2;)
alert tls $HOME_NET any -> 52.241.248.38 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f9e0f3b32a76084b22764eaebf4835b723a3f2430fa6266aa4759a23467b40a3"; reference:url,publicmosaic.com/indicators; sid:9100880; rev:2;)
alert tls $HOME_NET any -> 52.241.248.38 56002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f9e0f3b32a76084b22764eaebf4835b723a3f2430fa6266aa4759a23467b40a3"; reference:url,publicmosaic.com/indicators; sid:9101139; rev:2;)
alert tls $HOME_NET any -> 52.241.248.38 56003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f9e0f3b32a76084b22764eaebf4835b723a3f2430fa6266aa4759a23467b40a3"; reference:url,publicmosaic.com/indicators; sid:9101138; rev:2;)
alert tls $HOME_NET any -> 64.89.160.4 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"d5df6d7153adbea5c824471bd3e4e72b94ac1df83105e8bbf1bfb0cde375c0f8"; reference:url,publicmosaic.com/indicators; sid:9100041; rev:2;)
alert tls $HOME_NET any -> 64.89.160.29 19132 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"19b7360ff7b53ea3e95bc8de2bbb42c5f56199ca2e3dbb6a9e2fe8f358b43dda"; reference:url,publicmosaic.com/indicators; sid:9104152; rev:2;)
alert tls $HOME_NET any -> 64.89.160.47 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"25863286a52c674f369fb372a4312871a12c01f05e4e1a99a19b3140712ec3ff"; reference:url,publicmosaic.com/indicators; sid:9101655; rev:2;)
alert tls $HOME_NET any -> 67.205.154.243 36825 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"56a74bcdb336f28d46321e930facf7408e2f4d14c2c32c1a13c18ca69e302c6c"; reference:url,publicmosaic.com/indicators; sid:9104964; rev:2;)
alert tls $HOME_NET any -> 67.210.97.40 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"22c6e12e85afca2a3bc24d3b01f3fad69910318556cb8ec9e0a46f388413f8ab"; reference:url,publicmosaic.com/indicators; sid:9104411; rev:2;)
alert tls $HOME_NET any -> 67.210.97.40 56002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"22c6e12e85afca2a3bc24d3b01f3fad69910318556cb8ec9e0a46f388413f8ab"; reference:url,publicmosaic.com/indicators; sid:9104421; rev:2;)
alert tls $HOME_NET any -> 67.210.97.40 56003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"22c6e12e85afca2a3bc24d3b01f3fad69910318556cb8ec9e0a46f388413f8ab"; reference:url,publicmosaic.com/indicators; sid:9104424; rev:2;)
alert tls $HOME_NET any -> 69.166.66.88 4480 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"33d458fa525748cbde886ad035d93dafd9b9f4afafaf7238512547179516aeb9"; reference:url,publicmosaic.com/indicators; sid:9101438; rev:2;)
alert tls $HOME_NET any -> 71.201.61.136 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"9ff4d76f45cb9c902fc2a08376b6e5d9d91d100ace2fd221fb2623f053b86f29"; reference:url,publicmosaic.com/indicators; sid:9105097; rev:2;)
alert tls $HOME_NET any -> 72.155.73.165 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"ecc36d8ae6982617b86bdfadc32da855890f57c512e31332879e8470b386398c"; reference:url,publicmosaic.com/indicators; sid:9100040; rev:2;)
alert tls $HOME_NET any -> 82.29.94.69 1933 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c80424886832e6a8ca4616f7bc0d4cbe8a4da0a5efc5c3b07d80798b6099343b"; reference:url,publicmosaic.com/indicators; sid:9102266; rev:2;)
alert tls $HOME_NET any -> 83.106.88.18 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"2ef65105e978bb66fe383b68316b6b3087b92def2633461500b445893d90b4db"; reference:url,publicmosaic.com/indicators; sid:9101467; rev:2;)
alert tls $HOME_NET any -> 83.147.192.25 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8eeffea300c9ce16382c64052a864276bba46ba9f253d9e57138149bfe9c3432"; reference:url,publicmosaic.com/indicators; sid:9104061; rev:2;)
alert tls $HOME_NET any -> 83.147.192.25 56002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8eeffea300c9ce16382c64052a864276bba46ba9f253d9e57138149bfe9c3432"; reference:url,publicmosaic.com/indicators; sid:9104063; rev:2;)
alert tls $HOME_NET any -> 83.147.192.25 56003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8eeffea300c9ce16382c64052a864276bba46ba9f253d9e57138149bfe9c3432"; reference:url,publicmosaic.com/indicators; sid:9104062; rev:2;)
alert tls $HOME_NET any -> 85.137.51.189 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"811dc80f75a0d810427b91811e2057fa70184890281ac11a17464216178071ee"; reference:url,publicmosaic.com/indicators; sid:9101308; rev:2;)
alert tls $HOME_NET any -> 89.45.45.149 4785 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"67bea218d8d38cd2b0d88414a45cd68d32b59bc2dfb16f765c2ebca4ac8e2f07"; reference:url,publicmosaic.com/indicators; sid:9104681; rev:2;)
alert tls $HOME_NET any -> 91.92.240.102 3000 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"22c12e45f24935d9fed14b3c5bd2926d799fdaaff64c73cd019e8e6443c40c51"; reference:url,publicmosaic.com/indicators; sid:9101196; rev:2;)
alert tls $HOME_NET any -> 92.101.1.239 1604 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"d5ffb3b67abca38c6fac941396c5bc8d4f4ecb91d746513aa0764f77cc6fb813"; reference:url,publicmosaic.com/indicators; sid:9100854; rev:2;)
alert tls $HOME_NET any -> 94.26.68.54 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"3b5a4f4c490c501d56a222be0be5ece7a25f10bbffdf220a5225dde5a8e280b4"; reference:url,publicmosaic.com/indicators; sid:9101136; rev:2;)
alert tls $HOME_NET any -> 95.214.53.90 2354 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"4c1ec8e09415627cfd608ba2c3cf87a148fb5881a50b70054066895b6dbc119a"; reference:url,publicmosaic.com/indicators; sid:9106163; rev:2;)
alert tls $HOME_NET any -> 98.142.250.238 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"fee98c130e1759ffde761068e5546ffecaffa62d524e9a4fc03038f09ea987b6"; reference:url,publicmosaic.com/indicators; sid:9100033; rev:2;)
alert tls $HOME_NET any -> 101.37.22.150 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"51ea33ad911106e46abf997820b4c2443a1d1acaa3ae365cd4954b29087f4de4"; reference:url,publicmosaic.com/indicators; sid:9100127; rev:2;)
alert tls $HOME_NET any -> 101.99.92.134 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"93e4ed0eebb2613cde545e281400b5181bce46d22f838173fa8802cf7a72abfa"; reference:url,publicmosaic.com/indicators; sid:9102265; rev:2;)
alert tls $HOME_NET any -> 101.201.150.204 8888 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"53945878ce4f2c016b7ac95c05391d8dac68a01d503f0a88ffbe0253de398230"; reference:url,publicmosaic.com/indicators; sid:9102264; rev:2;)
alert tls $HOME_NET any -> 103.27.109.233 2200 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"ea20b971a743a2108832ab01157b30950558b556b5aa4ae32c83efc61ac00653"; reference:url,publicmosaic.com/indicators; sid:9102263; rev:2;)
alert tls $HOME_NET any -> 103.87.9.132 4787 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c2274bc2950e36f4791b22e9aee7bc88ff992c675f1c8b0448e96618575db5c8"; reference:url,publicmosaic.com/indicators; sid:9102262; rev:2;)
alert tls $HOME_NET any -> 103.89.13.21 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dfe8d2de6f10eeac38cc9f0117c3db847f7b7029fb1eec6e8dad3127e8dde395"; reference:url,publicmosaic.com/indicators; sid:9106654; rev:2;)
alert tls $HOME_NET any -> 103.101.85.103 4747 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"d2bf4f2991fafda76b213783419a03b156b58187a13a37f4c740ee17e8202f45"; reference:url,publicmosaic.com/indicators; sid:9102261; rev:2;)
alert tls $HOME_NET any -> 103.101.85.111 4747 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"d2bf4f2991fafda76b213783419a03b156b58187a13a37f4c740ee17e8202f45"; reference:url,publicmosaic.com/indicators; sid:9102260; rev:2;)
alert tls $HOME_NET any -> 103.106.67.96 1020 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e4ee33abac3831f4776571acc7c75f641d22be17a2ea06fb8bf8d296d803bc90"; reference:url,publicmosaic.com/indicators; sid:9105108; rev:2;)
alert tls $HOME_NET any -> 103.133.178.24 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"242d14cef5787cc31a776e5f2879ddcba399167c803567c368f14afaf69fdf0f"; reference:url,publicmosaic.com/indicators; sid:9102259; rev:2;)
alert tls $HOME_NET any -> 103.195.246.26 4444 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5c723b8ca2d88c6b3770a54b53d21fbaf9f1bc138f75d1e4b982c2d005b96b96"; reference:url,publicmosaic.com/indicators; sid:9104932; rev:2;)
alert tls $HOME_NET any -> 103.238.74.98 7004 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"198ee29374be34739da7434fcda0b57773236ecd681b59dff5c7ee086b110cd0"; reference:url,publicmosaic.com/indicators; sid:9103631; rev:2;)
alert tls $HOME_NET any -> 104.36.229.142 58003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c609d756e318d950ed824105bd3644fffe57f4d4aa66af8380bc1c84e95d529a"; reference:url,publicmosaic.com/indicators; sid:9100116; rev:2;)
alert tls $HOME_NET any -> 104.194.135.115 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"504b180277955776580add51d2a6d5cddeaedb5672c2c508f246c0fc2c5ebea3"; reference:url,publicmosaic.com/indicators; sid:9105107; rev:2;)
alert tls $HOME_NET any -> 104.194.135.149 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"504b180277955776580add51d2a6d5cddeaedb5672c2c508f246c0fc2c5ebea3"; reference:url,publicmosaic.com/indicators; sid:9105106; rev:2;)
alert tls $HOME_NET any -> 104.194.135.211 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"504b180277955776580add51d2a6d5cddeaedb5672c2c508f246c0fc2c5ebea3"; reference:url,publicmosaic.com/indicators; sid:9105105; rev:2;)
alert tls $HOME_NET any -> 104.243.43.193 9000 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e0dc8ac27bac725a2f0abfdf45c514908d164970323e920341f1db60509c0fca"; reference:url,publicmosaic.com/indicators; sid:9101320; rev:2;)
alert tls $HOME_NET any -> 104.243.43.193 9001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e0dc8ac27bac725a2f0abfdf45c514908d164970323e920341f1db60509c0fca"; reference:url,publicmosaic.com/indicators; sid:9101318; rev:2;)
alert tls $HOME_NET any -> 104.243.43.193 9002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e0dc8ac27bac725a2f0abfdf45c514908d164970323e920341f1db60509c0fca"; reference:url,publicmosaic.com/indicators; sid:9101319; rev:2;)
alert tls $HOME_NET any -> 108.136.51.214 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"4b18b21245e49bb46583277e4bb823cd80d0dd3cb78f1fcc7ca962746dd34a60"; reference:url,publicmosaic.com/indicators; sid:9104113; rev:2;)
alert tls $HOME_NET any -> 108.187.4.95 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"6e725550d4977c2272d45c991f1e7798a5474f16a58707b8544f0053f652f509"; reference:url,publicmosaic.com/indicators; sid:9100878; rev:2;)
alert tcp $HOME_NET any -> 111.229.4.108 8955 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106653; rev:2;)
alert tcp $HOME_NET any -> 114.132.227.144 37891 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106770; rev:2;)
alert tls $HOME_NET any -> 118.25.103.144 8888 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8c52b7e4d0dd6952fdb9df975065242f20d86f51bfae45a7c5a5fc2cfef803e2"; reference:url,publicmosaic.com/indicators; sid:9100824; rev:2;)
alert tls $HOME_NET any -> 118.25.188.245 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9100110; rev:2;)
alert tls $HOME_NET any -> 118.107.23.32 8693 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"02362a00810650c93b9d845bc237fc929e5e5d9154b7e37bbfa4c3aecb140e00"; reference:url,publicmosaic.com/indicators; sid:9102258; rev:2;)
alert tls $HOME_NET any -> 118.126.97.69 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"0927c841093700593445f3b78da0094f1c0508368eb2d2eb7180d2c2a079e2c0"; reference:url,publicmosaic.com/indicators; sid:9102257; rev:2;)
alert tcp $HOME_NET any -> 119.3.85.18 4443 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106651; rev:2;)
alert tcp $HOME_NET any -> 120.26.136.167 8088 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106438; rev:2;)
alert tls $HOME_NET any -> 121.169.59.210 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"1da8c3c22945ed177260b22c9b0207650c39d83e537f226a28d5c9cfd7e264bb"; reference:url,publicmosaic.com/indicators; sid:9100514; rev:2;)
alert tls $HOME_NET any -> 125.86.22.29 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5edc16157c7b887458b353f4da358633f3e4399c6c112f2656e6af03f5b974f1"; reference:url,publicmosaic.com/indicators; sid:9100183; rev:2;)
alert tls $HOME_NET any -> 125.86.26.79 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5edc16157c7b887458b353f4da358633f3e4399c6c112f2656e6af03f5b974f1"; reference:url,publicmosaic.com/indicators; sid:9100109; rev:2;)
alert tls $HOME_NET any -> 130.12.180.237 8888 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c609d756e318d950ed824105bd3644fffe57f4d4aa66af8380bc1c84e95d529a"; reference:url,publicmosaic.com/indicators; sid:9101733; rev:2;)
alert tls $HOME_NET any -> 130.12.181.96 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"55b2b97da3a6644cd076abf780f18288019268f285a35aa5e51dd657b8365e06"; reference:url,publicmosaic.com/indicators; sid:9104511; rev:2;)
alert tls $HOME_NET any -> 134.175.87.25 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dc2f5830ef7a7aa316b710e05805b169767edb0ada1fd91bb3969f51e19c2e9f"; reference:url,publicmosaic.com/indicators; sid:9102256; rev:2;)
alert tls $HOME_NET any -> 139.59.23.248 57338 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5b1b4ce8f02f0f5d9e11c28425ded704647a9392e8f247729b37c66cf21af826"; reference:url,publicmosaic.com/indicators; sid:9102255; rev:2;)
alert tls $HOME_NET any -> 144.31.168.71 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f0e5edb6efbde650b993cab0d9abf392a6d7cbd0ab1c27544fefb38038fedaa2"; reference:url,publicmosaic.com/indicators; sid:9101316; rev:2;)
alert tls $HOME_NET any -> 147.124.216.194 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"1c9e8de5c20973d493b28b28eea8db09adf83b9477685da7352e356c96285337"; reference:url,publicmosaic.com/indicators; sid:9103301; rev:2;)
alert tls $HOME_NET any -> 147.124.216.194 56002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"1c9e8de5c20973d493b28b28eea8db09adf83b9477685da7352e356c96285337"; reference:url,publicmosaic.com/indicators; sid:9103300; rev:2;)
alert tls $HOME_NET any -> 147.124.216.194 56003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"1c9e8de5c20973d493b28b28eea8db09adf83b9477685da7352e356c96285337"; reference:url,publicmosaic.com/indicators; sid:9103299; rev:2;)
alert tls $HOME_NET any -> 154.23.189.120 17788 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c61a826c565cc1f77b6cd0ae8bc19713babc1682cd6b578f2627d110cce4ac95"; reference:url,publicmosaic.com/indicators; sid:9100174; rev:2;)
alert tls $HOME_NET any -> 154.23.189.194 17788 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c61a826c565cc1f77b6cd0ae8bc19713babc1682cd6b578f2627d110cce4ac95"; reference:url,publicmosaic.com/indicators; sid:9100173; rev:2;)
alert tcp $HOME_NET any -> 154.23.189.222 17788 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106837; rev:2;)
alert tcp $HOME_NET any -> 156.254.6.103 2096 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106816; rev:2;)
alert tls $HOME_NET any -> 158.94.208.19 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"72be13aa8661f548968113cec883ba2e1423bab3c9cd801682f090b3ed28c281"; reference:url,publicmosaic.com/indicators; sid:9104445; rev:2;)
alert tls $HOME_NET any -> 159.223.5.148 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"bb8967b9b20cafd334b56b74a20c76ea760b10f15b4ea60743bfeca1e72098a7"; reference:url,publicmosaic.com/indicators; sid:9101657; rev:2;)
alert tls $HOME_NET any -> 160.119.69.30 2083 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"1612c000e65c48231a3dd13dd9f97ec6bb0696ab7c2b3f4dceae9263f3148af8"; reference:url,publicmosaic.com/indicators; sid:9101315; rev:2;)
alert tls $HOME_NET any -> 161.132.220.65 8080 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"7b22b94f2bba277174f8258bc9cd5195fd9371f6f3a68324cfba75ca87e414eb"; reference:url,publicmosaic.com/indicators; sid:9102254; rev:2;)
alert tls $HOME_NET any -> 166.88.90.59 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"11869588a86f589904d7ed760ea1ab76a5d9dc588b74929ba75734c15c874407"; reference:url,publicmosaic.com/indicators; sid:9100877; rev:2;)
alert tls $HOME_NET any -> 166.88.90.59 56002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"11869588a86f589904d7ed760ea1ab76a5d9dc588b74929ba75734c15c874407"; reference:url,publicmosaic.com/indicators; sid:9101175; rev:2;)
alert tls $HOME_NET any -> 166.88.90.59 56003 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"11869588a86f589904d7ed760ea1ab76a5d9dc588b74929ba75734c15c874407"; reference:url,publicmosaic.com/indicators; sid:9101176; rev:2;)
alert tls $HOME_NET any -> 167.148.201.29 56001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"5651b9cae132383865fc347107029f555f6bff20078e6d23ef5de47206be6a5a"; reference:url,publicmosaic.com/indicators; sid:9101177; rev:2;)
alert tls $HOME_NET any -> 172.81.132.29 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"9ab48651ad6b4872274421c0d2f07f5cbaedbdebe9d87cbcec8582318ec90d66"; reference:url,publicmosaic.com/indicators; sid:9101314; rev:2;)
alert tls $HOME_NET any -> 172.86.119.186 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"bc1841eafd44abd2a6ab70491fed35e5d1958921c51ea968772484e421ff39b5"; reference:url,publicmosaic.com/indicators; sid:9101313; rev:2;)
alert tls $HOME_NET any -> 172.94.9.166 2232 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8e4f450d33224b964d0c762dae4464e06dbb4b74d04b0b99ba7e86cf8cf4eb56"; reference:url,publicmosaic.com/indicators; sid:9100096; rev:2;)
alert tcp $HOME_NET any -> 172.94.18.198 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106560; rev:2;)
alert tls $HOME_NET any -> 172.94.32.132 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"ee705a724fab678259f5e2cae5ddafa2200f4943359c542e96808e8b4b9f5a9d"; reference:url,publicmosaic.com/indicators; sid:9105934; rev:2;)
alert tls $HOME_NET any -> 172.111.143.242 2025 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dbb4ded7b8471a03f55e2c83ff86ffaafb1f93c7021540d9a727ec14a42b427f"; reference:url,publicmosaic.com/indicators; sid:9101174; rev:2;)
alert tls $HOME_NET any -> 175.30.113.69 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"d5865704881747610814ecd154470245ecae90158e73b7946b75b6de01fb15b9"; reference:url,publicmosaic.com/indicators; sid:9102253; rev:2;)
alert tls $HOME_NET any -> 177.2.16.126 14782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c61a826c565cc1f77b6cd0ae8bc19713babc1682cd6b578f2627d110cce4ac95"; reference:url,publicmosaic.com/indicators; sid:9101656; rev:2;)
alert tcp $HOME_NET any -> 177.92.82.99 27015 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106815; rev:2;)
alert tls $HOME_NET any -> 177.141.179.146 11964 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"47d9608dffdb7d1eeee849fc206a0884306be47b3c1e6abd9846d8241d083ae6"; reference:url,publicmosaic.com/indicators; sid:9102252; rev:2;)
alert tls $HOME_NET any -> 178.16.54.229 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c0107e207bd8a3aeca4de50946c74e6abeb6a8568e8a5badbf5eab36559ba18c"; reference:url,publicmosaic.com/indicators; sid:9100093; rev:2;)
alert tls $HOME_NET any -> 185.34.147.31 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9100752; rev:2;)
alert tcp $HOME_NET any -> 185.34.147.32 443 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9101624; rev:2;)
alert tls $HOME_NET any -> 185.34.147.33 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101720; rev:2;)
alert tls $HOME_NET any -> 185.34.147.34 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101722; rev:2;)
alert tls $HOME_NET any -> 185.34.147.35 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"a943fc0fedb9e630b7eafbd06e24a96c45955f0e1c820a0504245880e32dba02"; reference:url,publicmosaic.com/indicators; sid:9101723; rev:2;)
alert tls $HOME_NET any -> 185.150.191.138 9002 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e0dc8ac27bac725a2f0abfdf45c514908d164970323e920341f1db60509c0fca"; reference:url,publicmosaic.com/indicators; sid:9101312; rev:2;)
alert tls $HOME_NET any -> 185.180.223.13 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f0e5edb6efbde650b993cab0d9abf392a6d7cbd0ab1c27544fefb38038fedaa2"; reference:url,publicmosaic.com/indicators; sid:9101311; rev:2;)
alert tls $HOME_NET any -> 185.231.154.75 5555 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"c1a966e7e46b419cd3ddfd442071e9bf7a4f98097195458fccc1e034efc6d96e"; reference:url,publicmosaic.com/indicators; sid:9100091; rev:2;)
alert tls $HOME_NET any -> 186.169.78.50 1100 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dcd3ab394b9829e2ef0045221eec43c0fb3e4484f1bfde75c0bfd567e1b8402a"; reference:url,publicmosaic.com/indicators; sid:9100426; rev:2;)
alert tls $HOME_NET any -> 186.169.78.50 6001 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"dcd3ab394b9829e2ef0045221eec43c0fb3e4484f1bfde75c0bfd567e1b8402a"; reference:url,publicmosaic.com/indicators; sid:9100083; rev:2;)
alert tls $HOME_NET any -> 189.253.224.195 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"f2c7428a5528892ca3823265d3348cbba8bd5e58297647204f6e7cc5c096710f"; reference:url,publicmosaic.com/indicators; sid:9104151; rev:2;)
alert tcp $HOME_NET any -> 192.3.136.229 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; reference:url,publicmosaic.com/indicators; sid:9106780; rev:2;)
alert tls $HOME_NET any -> 192.162.199.75 2222 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"bdd2ed46032920c5d74b9eced0bf103c4a1ccb7f795f748696b19be64a2924b7"; reference:url,publicmosaic.com/indicators; sid:9105648; rev:2;)
alert tls $HOME_NET any -> 193.108.114.185 17300 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"3383ad07764d95cd33f8d782716e40c2185e60ba7f5057efab17deffdec1a3ae"; reference:url,publicmosaic.com/indicators; sid:9104150; rev:2;)
alert tls $HOME_NET any -> 194.59.31.108 8727 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"26bcf325556d637e1fb96b23f5d214469bec5b88276989fef1bebb3378d0f1f2"; reference:url,publicmosaic.com/indicators; sid:9100078; rev:2;)
alert tls $HOME_NET any -> 196.251.107.148 2222 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"857339d9c5cb973edac178005c9e3a212efc8ff1f0eaff61f636e189978aadf4"; reference:url,publicmosaic.com/indicators; sid:9102251; rev:2;)
alert tls $HOME_NET any -> 209.145.59.89 443 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"e0247dbfec5e68b4e75cb2758930f27eea6d1f128e673bb7318420366a6f6458"; reference:url,publicmosaic.com/indicators; sid:9100513; rev:2;)
alert tls $HOME_NET any -> 211.161.232.30 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"839c4ababfffa401db6638c7f6f880d0209fd69bbf3cc7e9600ab3bd20ee8a55"; reference:url,publicmosaic.com/indicators; sid:9100158; rev:2;)
alert tls $HOME_NET any -> 213.165.52.215 1488 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"daa75fe99e67625dca51b587d858a2196b767b6a5739520afb4bce39f3cf597b"; reference:url,publicmosaic.com/indicators; sid:9104485; rev:2;)
alert tls $HOME_NET any -> 216.74.123.43 1 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"ee8b1c2b94a58afe0991e427515842c8ba77680984b395831d6856a7f6096e54"; reference:url,publicmosaic.com/indicators; sid:9104484; rev:2;)
alert tls $HOME_NET any -> 217.60.195.25 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"8af21871985903fa963836f77991476ed447eb070702e66a8eaac9f697f00977"; reference:url,publicmosaic.com/indicators; sid:9100876; rev:2;)
alert tls $HOME_NET any -> 217.156.65.42 4782 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"6bf7de6a313c070def9994138ec0c7f22e2df5ebee898f8a70321be590efab05"; reference:url,publicmosaic.com/indicators; sid:9101636; rev:2;)
alert tls $HOME_NET any -> 222.253.182.185 9090 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"07c9def22e6e01f0be0d4e97692d67736223bb6c48ba43c3a310e61ed9b4b9fe"; reference:url,publicmosaic.com/indicators; sid:9102250; rev:2;)
alert tls $HOME_NET any -> 222.255.215.8 9123 (msg:"HOLLOWPOINT C2 quasar_rat"; tls.cert_fingerprint; content:"3caefe50d6ef379dba84802cba9fc8909b14b492a09158231eedb7bd5a3c4b08"; reference:url,publicmosaic.com/indicators; sid:9102249; rev:2;)