# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 60 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: family supershell — https://publicmosaic.com/c2/supershell
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.117.77.166 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100512; rev:2;)
alert tcp $HOME_NET any -> 4.230.24.119 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9105294; rev:2;)
alert tcp $HOME_NET any -> 8.138.155.217 18888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102218; rev:2;)
alert tcp $HOME_NET any -> 8.138.180.67 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100511; rev:2;)
alert tcp $HOME_NET any -> 8.210.146.82 18888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100510; rev:2;)
alert tcp $HOME_NET any -> 8.218.120.126 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100497; rev:2;)
alert tcp $HOME_NET any -> 8.218.138.77 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100489; rev:2;)
alert tcp $HOME_NET any -> 18.179.34.241 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103991; rev:2;)
alert tcp $HOME_NET any -> 20.2.90.98 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102015; rev:2;)
alert tcp $HOME_NET any -> 20.2.139.87 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100486; rev:2;)
alert tcp $HOME_NET any -> 20.2.161.33 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100499; rev:2;)
alert tcp $HOME_NET any -> 20.89.182.93 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100490; rev:2;)
alert tcp $HOME_NET any -> 20.196.147.118 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100488; rev:2;)
alert tcp $HOME_NET any -> 20.255.154.56 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100493; rev:2;)
alert tcp $HOME_NET any -> 23.94.53.109 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9106781; rev:2;)
alert tcp $HOME_NET any -> 39.102.87.142 7777 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100492; rev:2;)
alert tcp $HOME_NET any -> 43.155.168.253 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101202; rev:2;)
alert tcp $HOME_NET any -> 45.8.46.122 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101200; rev:2;)
alert tcp $HOME_NET any -> 45.145.228.16 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102217; rev:2;)
alert tcp $HOME_NET any -> 45.145.228.142 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100509; rev:2;)
alert tcp $HOME_NET any -> 45.221.118.69 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102216; rev:2;)
alert tcp $HOME_NET any -> 47.74.242.253 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9105147; rev:2;)
alert tcp $HOME_NET any -> 47.84.3.75 21731 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103782; rev:2;)
alert tcp $HOME_NET any -> 47.96.125.204 40945 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103781; rev:2;)
alert tcp $HOME_NET any -> 47.238.112.8 50888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101143; rev:2;)
alert tcp $HOME_NET any -> 47.242.62.96 15800 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101141; rev:2;)
alert tcp $HOME_NET any -> 47.254.73.23 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100487; rev:2;)
alert tcp $HOME_NET any -> 54.95.7.136 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9105027; rev:2;)
alert tcp $HOME_NET any -> 101.37.210.236 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9104197; rev:2;)
alert tcp $HOME_NET any -> 101.42.104.134 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100491; rev:2;)
alert tcp $HOME_NET any -> 101.133.172.90 8787 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100498; rev:2;)
alert tcp $HOME_NET any -> 103.43.18.10 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100508; rev:2;)
alert tcp $HOME_NET any -> 103.43.71.150 5858 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100507; rev:2;)
alert tcp $HOME_NET any -> 103.233.8.39 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100506; rev:2;)
alert tcp $HOME_NET any -> 103.233.8.46 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100496; rev:2;)
alert tcp $HOME_NET any -> 107.189.28.92 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100505; rev:2;)
alert tcp $HOME_NET any -> 110.40.147.249 7777 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100494; rev:2;)
alert tcp $HOME_NET any -> 113.45.238.149 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100504; rev:2;)
alert tcp $HOME_NET any -> 114.66.58.253 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100503; rev:2;)
alert tcp $HOME_NET any -> 114.132.251.233 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100500; rev:2;)
alert tcp $HOME_NET any -> 115.191.18.57 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100502; rev:2;)
alert tcp $HOME_NET any -> 117.72.38.14 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100501; rev:2;)
alert tcp $HOME_NET any -> 117.72.72.254 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100495; rev:2;)
alert tcp $HOME_NET any -> 117.72.119.63 7088 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102215; rev:2;)
alert tcp $HOME_NET any -> 117.72.202.93 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9104509; rev:2;)
alert tcp $HOME_NET any -> 119.45.190.210 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100485; rev:2;)
alert tcp $HOME_NET any -> 120.78.121.146 8035 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9103780; rev:2;)
alert tcp $HOME_NET any -> 123.56.48.58 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102214; rev:2;)
alert tcp $HOME_NET any -> 124.221.221.58 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100479; rev:2;)
alert tcp $HOME_NET any -> 124.248.66.207 19999 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9102212; rev:2;)
alert tcp $HOME_NET any -> 140.143.130.157 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100477; rev:2;)
alert tcp $HOME_NET any -> 143.92.60.13 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100484; rev:2;)
alert tcp $HOME_NET any -> 143.92.60.24 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100881; rev:2;)
alert tcp $HOME_NET any -> 143.92.60.26 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100482; rev:2;)
alert tcp $HOME_NET any -> 152.42.180.208 8875 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9101984; rev:2;)
alert tcp $HOME_NET any -> 152.136.56.105 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9104507; rev:2;)
alert tcp $HOME_NET any -> 160.250.128.197 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100483; rev:2;)
alert tcp $HOME_NET any -> 166.108.206.56 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100481; rev:2;)
alert tcp $HOME_NET any -> 183.60.226.2 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100480; rev:2;)
alert tcp $HOME_NET any -> 207.57.123.251 8888 (msg:"HOLLOWPOINT C2 supershell"; reference:url,publicmosaic.com/indicators; sid:9100478; rev:2;)