# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 62 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 000000000000_000000000000_e1926048963f — https://publicmosaic.com/ja4x/000000000000_000000000000_e1926048963f
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 2.26.229.254 4433 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3a13bcab9f738bff6b31937a6c7616f809a74bcbe15031f2a4834e0cf0d4a593"; reference:url,publicmosaic.com/indicators; sid:9100622; rev:2;)
alert tls $HOME_NET any -> 8.137.111.232 4433 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"9bd353a8df5df3e5f52479fe6579198f4e87a5092a5b586da5ccde6a74ac554d"; reference:url,publicmosaic.com/indicators; sid:9101475; rev:2;)
alert tls $HOME_NET any -> 13.212.38.253 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5eb5010cfeca535f9ebaf7ed3c10b8b0350a31c0c1a511f8c529a2de5e0bddd7"; reference:url,publicmosaic.com/indicators; sid:9100621; rev:2;)
alert tls $HOME_NET any -> 18.143.169.148 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"63e8f71cc0d01b4119c2d1e2668a4116e1521c4f3e2e886e10e1ad70dde6c00c"; reference:url,publicmosaic.com/indicators; sid:9100615; rev:2;)
alert tls $HOME_NET any -> 20.119.73.195 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b9f161c65ab5abd68dd6e2e1f430fd1256ae3ab982560127774fd6ff42812f52"; reference:url,publicmosaic.com/indicators; sid:9101461; rev:2;)
alert tls $HOME_NET any -> 23.227.199.61 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"03dfb54d538b85b4e662fa5836fb342810e057f9b826b44589a8a372a8e7e537"; reference:url,publicmosaic.com/indicators; sid:9105693; rev:2;)
alert tls $HOME_NET any -> 23.227.199.67 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"be2c76cb20aca3a56fd4e323b8f39e2f2318f6aa40117d9756ec7977059db37a"; reference:url,publicmosaic.com/indicators; sid:9104065; rev:2;)
alert tls $HOME_NET any -> 23.227.203.71 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"1091aad9bb141c29479785b12f45e464c63f2faabd46fc4259484fd4c3dff9ce"; reference:url,publicmosaic.com/indicators; sid:9105694; rev:2;)
alert tls $HOME_NET any -> 23.227.203.190 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5740008dd50535f26547f3de788983cbe8e104f114ddba77ba4b3b43a6b39ecb"; reference:url,publicmosaic.com/indicators; sid:9104146; rev:2;)
alert tls $HOME_NET any -> 23.227.203.191 10443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2327f227dd47115072e42630b93a93c3ad2bd9e23fcd59b59666072fd3cba70c"; reference:url,publicmosaic.com/indicators; sid:9106451; rev:2;)
alert tls $HOME_NET any -> 23.227.203.246 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5dcbcc488db3d7c82ba59de50f78637b50c277f3a848bbab3c92cb36fc530405"; reference:url,publicmosaic.com/indicators; sid:9103960; rev:2;)
alert tls $HOME_NET any -> 31.56.228.50 4433 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"98fa089be61b170f2d7aeae1b628fa58cf8d2cb2b89966ac6816828a2840113c"; reference:url,publicmosaic.com/indicators; sid:9106646; rev:2;)
alert tls $HOME_NET any -> 31.56.228.50 4443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2181c861f0f6795d68d728117ad836afd1c7e20796b76c6a7420db818c476fdc"; reference:url,publicmosaic.com/indicators; sid:9100620; rev:2;)
alert tls $HOME_NET any -> 31.58.87.123 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e5b22328a6b197024e969d1e13295c0a02cf459440978536a9aafdc3cfe5d11d"; reference:url,publicmosaic.com/indicators; sid:9101460; rev:2;)
alert tls $HOME_NET any -> 31.77.161.250 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"28c40f62e4e11c6df443308c21331dd8215cae5def8b93fce2bd52fe05bf27bc"; reference:url,publicmosaic.com/indicators; sid:9105109; rev:2;)
alert tls $HOME_NET any -> 37.72.168.163 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f22e2129516bc50da447291c705cf8fd47ad26110f54b9f5474dd5d7cf49b39c"; reference:url,publicmosaic.com/indicators; sid:9104144; rev:2;)
alert tls $HOME_NET any -> 38.54.63.135 80 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"43cec44e4918df6b585bb6c3d9ad72f38e6d8861e71f8fe7a873706b27060783"; reference:url,publicmosaic.com/indicators; sid:9100619; rev:2;)
alert tls $HOME_NET any -> 38.60.212.240 80 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2396af38b5604bb98e6ca10873068f940582149d30b2dc47c3eeab85ecbd43a4"; reference:url,publicmosaic.com/indicators; sid:9105801; rev:2;)
alert tls $HOME_NET any -> 38.132.122.141 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"09b63d9c88dd74351d09a452bfa8846128fa45dd72919441e76506a9a0f3214e"; reference:url,publicmosaic.com/indicators; sid:9104068; rev:2;)
alert tls $HOME_NET any -> 38.132.122.145 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f408f58ef0693af9b5b5971a7983ef840ede77bad81028cd5d95fd35af5bf52c"; reference:url,publicmosaic.com/indicators; sid:9105014; rev:2;)
alert tls $HOME_NET any -> 38.132.122.161 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c6dc0ff23814ae8acfb2ec7f4833d664f43ccdf41a8e73d40043758d54aa9e61"; reference:url,publicmosaic.com/indicators; sid:9103952; rev:2;)
alert tls $HOME_NET any -> 39.105.16.200 4443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3b3912189d4c9955a186d57cfec7d5efca9d7f48be403dd5719f596a80cdf4e6"; reference:url,publicmosaic.com/indicators; sid:9101455; rev:2;)
alert tls $HOME_NET any -> 43.135.34.69 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"1befcd3a15cbd1524d43e494bb416033da50f9e8ada46ec406c30cbcd2baf001"; reference:url,publicmosaic.com/indicators; sid:9100676; rev:2;)
alert tls $HOME_NET any -> 43.163.111.133 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"16a758b6bd68bebb821805bfa9b03eff5b78416867709b5ba0de1943551540e9"; reference:url,publicmosaic.com/indicators; sid:9100618; rev:2;)
alert tls $HOME_NET any -> 45.76.191.22 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"9d2ad995c7157bf2c279bc8534a6452e543ced4c26af0c0cba7d4078e8a6c114"; reference:url,publicmosaic.com/indicators; sid:9105676; rev:2;)
alert tls $HOME_NET any -> 45.77.203.212 9443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"13ba5abee9772b3ed9a9ee020ee1c768fe4bff621cd2a8672a8df22fda710690"; reference:url,publicmosaic.com/indicators; sid:9100616; rev:2;)
alert tls $HOME_NET any -> 45.155.69.153 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"72b8cebc00ec65195a48fe7d4fd639686462f14cb629ab40794f94919453903c"; reference:url,publicmosaic.com/indicators; sid:9101305; rev:2;)
alert tls $HOME_NET any -> 45.155.69.175 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"721d398c58f27e9e0ad31f3fe347c7b7ce16b6122e84fd9cf6f424258e083c5b"; reference:url,publicmosaic.com/indicators; sid:9100670; rev:2;)
alert tls $HOME_NET any -> 46.21.153.146 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"215d4b8052848438302d8a45f227bd3857eb560ce2a4c86cb8b704d74951396f"; reference:url,publicmosaic.com/indicators; sid:9104145; rev:2;)
alert tls $HOME_NET any -> 46.21.153.148 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4889172836ce68562081c1a7b72b8855649578cfefcdc045bcdb835248a3f959"; reference:url,publicmosaic.com/indicators; sid:9103964; rev:2;)
alert tls $HOME_NET any -> 52.22.15.69 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"fb9ee97dc8dff1c25d9b238f6fbd5e5d2e569c1a77637fa02d1e6d9e8c3012dd"; reference:url,publicmosaic.com/indicators; sid:9100782; rev:2;)
alert tls $HOME_NET any -> 54.173.174.159 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f76377c291a730fdbc1d853058d2cdbf274a95cf6478f580e861ab7551a413b7"; reference:url,publicmosaic.com/indicators; sid:9106644; rev:2;)
alert tls $HOME_NET any -> 64.176.199.134 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6148d1645de00d483f0975c8f3bc14b56ed45ab08b52222bb2854b4db663326b"; reference:url,publicmosaic.com/indicators; sid:9101532; rev:2;)
alert tls $HOME_NET any -> 65.21.102.4 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2fb895201389ced3144f1cdb4433570aa790d2dfeb24aee44992d83bab778e04"; reference:url,publicmosaic.com/indicators; sid:9100614; rev:2;)
alert tls $HOME_NET any -> 79.135.160.20 8000 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"342d54bd2ea7e6ebdbf409f4a1de6815a48045dc600e8667a52ed02d9d58b611"; reference:url,publicmosaic.com/indicators; sid:9100613; rev:2;)
alert tls $HOME_NET any -> 101.33.202.134 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d98e8c33630938fe85a2b8a40947a3fa3c31861532c956a61a26575ac8103352"; reference:url,publicmosaic.com/indicators; sid:9104069; rev:2;)
alert tls $HOME_NET any -> 103.27.110.141 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"8083f4282941fa81b64c655a6964f0221492b5f0a94c54fb2d109042d1db0333"; reference:url,publicmosaic.com/indicators; sid:9100611; rev:2;)
alert tls $HOME_NET any -> 103.51.145.75 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"62a3917f779e7d6212a3079b60f198a29115be28cdf2ba6564af81dbe2f71483"; reference:url,publicmosaic.com/indicators; sid:9100610; rev:2;)
alert tls $HOME_NET any -> 103.139.202.6 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4c50d02eab611087c78b92094ae64b9c55f419f43881b2d0880fa193951f5620"; reference:url,publicmosaic.com/indicators; sid:9105797; rev:2;)
alert tls $HOME_NET any -> 103.140.154.7 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e1c568c00ad849b4a51cce758b1495b735f89126ea4bf994432a9f4de2cee557"; reference:url,publicmosaic.com/indicators; sid:9101563; rev:2;)
alert tls $HOME_NET any -> 104.131.25.122 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5b25a2767c5522c964955d01be599b9873430dfad1081876f943995b27cfdc9f"; reference:url,publicmosaic.com/indicators; sid:9100609; rev:2;)
alert tls $HOME_NET any -> 107.172.140.187 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"45cf5ab9ac981e6677e2fca4ade763842cb3e44ae547dbe23f061c32ae75d5de"; reference:url,publicmosaic.com/indicators; sid:9100608; rev:2;)
alert tls $HOME_NET any -> 113.44.168.133 8080 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"bee4e90f14244974a24f1ed9e1161e9e3ad88578692d71e017876994c60ba44a"; reference:url,publicmosaic.com/indicators; sid:9100607; rev:2;)
alert tls $HOME_NET any -> 138.16.179.204 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"864ffaab4e249036dcd3c1345ee88c41d98092e657501a0d8472cb9698eea5f9"; reference:url,publicmosaic.com/indicators; sid:9100605; rev:2;)
alert tls $HOME_NET any -> 146.70.87.96 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2492351c160e5c1f3e03d93bfacf5a3d987f578efe6b3453d308817e20673edf"; reference:url,publicmosaic.com/indicators; sid:9105688; rev:2;)
alert tls $HOME_NET any -> 146.70.87.218 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c4145c0920040c4970463e17682912fd31b022121e3af42d7173b7ee534d7321"; reference:url,publicmosaic.com/indicators; sid:9105689; rev:2;)
alert tls $HOME_NET any -> 146.70.87.237 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"8829c6ec250e512262444c635f0947ffe6c7b7e74e86082ca2b4f8ec879ac80f"; reference:url,publicmosaic.com/indicators; sid:9106192; rev:2;)
alert tls $HOME_NET any -> 149.202.227.107 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ce8454cebc9dc243ab31676e608f9fb420fb9a4c13172dd7b7e68c4205ef62fe"; reference:url,publicmosaic.com/indicators; sid:9100604; rev:2;)
alert tls $HOME_NET any -> 162.35.172.146 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3f5aced2a1197db1c0411fd637a6df10103baf6516f204b904956dafd3f5f9e4"; reference:url,publicmosaic.com/indicators; sid:9105690; rev:2;)
alert tls $HOME_NET any -> 169.40.135.227 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6ad311f8d0a73e05208fdc825c6a13f498193d992be31bdd337d4f308ae0de81"; reference:url,publicmosaic.com/indicators; sid:9100601; rev:2;)
alert tls $HOME_NET any -> 173.199.70.174 80 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"620710d952c181e3e4a5476b01f6625f21516b7bdcb072f40dd0ea6961641850"; reference:url,publicmosaic.com/indicators; sid:9100693; rev:2;)
alert tls $HOME_NET any -> 178.16.52.22 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"68932e254d6e12e74c19a2afd861566b989afc207afab4c1429aa16b9572f92c"; reference:url,publicmosaic.com/indicators; sid:9100600; rev:2;)
alert tls $HOME_NET any -> 185.9.17.227 4443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d5697a83e5b99cd02559a6d2b62e9b24bbb9b1cf4b80065d7410c9ccf46017a9"; reference:url,publicmosaic.com/indicators; sid:9101500; rev:2;)
alert tls $HOME_NET any -> 185.9.17.227 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d5697a83e5b99cd02559a6d2b62e9b24bbb9b1cf4b80065d7410c9ccf46017a9"; reference:url,publicmosaic.com/indicators; sid:9101501; rev:2;)
alert tls $HOME_NET any -> 185.199.197.93 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0ee3292ea7a8a99466c2444bd75871ee1381adcb5a52952978d13a6931ea79d3"; reference:url,publicmosaic.com/indicators; sid:9100597; rev:2;)
alert tls $HOME_NET any -> 185.242.245.120 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"738f2c43746d31eb7bae4ea29e4d4f019b9086a8249185419682ecc65d0ba597"; reference:url,publicmosaic.com/indicators; sid:9100635; rev:2;)
alert tls $HOME_NET any -> 188.166.244.201 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7942e59619f61bcd32072eb52dfbf99aa402c1c2b89d4e6c5512b5696d55e657"; reference:url,publicmosaic.com/indicators; sid:9100596; rev:2;)
alert tls $HOME_NET any -> 193.42.24.165 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6c3a8c914e550eef17a4b7069b5b3d5102acaad07c922aafc02ebcfc263b8984"; reference:url,publicmosaic.com/indicators; sid:9100781; rev:2;)
alert tls $HOME_NET any -> 206.81.21.156 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e1d16aca4c140a79f18f272d7800a7151c68162295075a626820b86bf553772c"; reference:url,publicmosaic.com/indicators; sid:9100595; rev:2;)
alert tls $HOME_NET any -> 207.57.123.129 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"07849910402fdf9cf51be702d266c020172d1275047c5ae17f0a7ad89185c0f7"; reference:url,publicmosaic.com/indicators; sid:9100594; rev:2;)
alert tls $HOME_NET any -> 209.99.188.193 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"41f782a33467143ac6ddd941152c99a98172e55df119a65771b3bf42bd39d311"; reference:url,publicmosaic.com/indicators; sid:9100593; rev:2;)
alert tls $HOME_NET any -> 213.199.53.152 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2b1a381b6ce13c62bdcbe0edcb9d24f809337d43bda7ce260a14c5181494549b"; reference:url,publicmosaic.com/indicators; sid:9101562; rev:2;)