# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 39 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 000000000000_7022c563de38_bf0f0589fc03 — https://publicmosaic.com/ja4x/000000000000_7022c563de38_bf0f0589fc03
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 8
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 8.219.149.222 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"82f36ce027070c7d0c70144461ae17f5f4fce10b0f25b03669d6ee20c99a0dba"; reference:url,publicmosaic.com/indicators; sid:9104466; rev:2;)
alert tls $HOME_NET any -> 8.219.149.222 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"82f36ce027070c7d0c70144461ae17f5f4fce10b0f25b03669d6ee20c99a0dba"; reference:url,publicmosaic.com/indicators; sid:9104465; rev:2;)
alert tls $HOME_NET any -> 23.95.230.28 4444 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b9c34eb1d6b4a51e89102387b041c22073d0970be01a06fd48a8c241804ea7bb"; reference:url,publicmosaic.com/indicators; sid:9100741; rev:2;)
alert tls $HOME_NET any -> 31.76.111.38 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"951197838d59e56408025a4d26914bed91814c73b0e6af76b9a20d9847e2866c"; reference:url,publicmosaic.com/indicators; sid:9100777; rev:2;)
alert tls $HOME_NET any -> 31.76.111.243 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"951197838d59e56408025a4d26914bed91814c73b0e6af76b9a20d9847e2866c"; reference:url,publicmosaic.com/indicators; sid:9101704; rev:2;)
alert tls $HOME_NET any -> 31.77.220.141 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"7c3c93d32334cf7056efb108a8f96b94b5c5420a5b854ce4923b6752be5d01e9"; reference:url,publicmosaic.com/indicators; sid:9106195; rev:2;)
alert tls $HOME_NET any -> 38.60.220.112 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f6e82441c228e618f3f6da47b7beb6b0dec17838b14d41b358e5f1b0bffcda71"; reference:url,publicmosaic.com/indicators; sid:9101703; rev:2;)
alert tls $HOME_NET any -> 43.134.169.103 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"fef947905e4d8816008fb3095c18f245f6b7cd466d7720667e20c67ae29b66fc"; reference:url,publicmosaic.com/indicators; sid:9104200; rev:2;)
alert tls $HOME_NET any -> 43.136.132.144 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"44910293403197211239c812e5d38a65e4c260ad8e9316225ab64ff75ff1d7ab"; reference:url,publicmosaic.com/indicators; sid:9100776; rev:2;)
alert tls $HOME_NET any -> 43.157.204.73 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9c9f75b9e849e602d355ac9743b24c9acd5f58c5c5f22e152859df2809b70567"; reference:url,publicmosaic.com/indicators; sid:9104464; rev:2;)
alert tls $HOME_NET any -> 45.38.20.151 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b6e8be28cee97ffe2cce33984e6b68af9d127c1992ade2599928df295d50e6c8"; reference:url,publicmosaic.com/indicators; sid:9106346; rev:2;)
alert tls $HOME_NET any -> 45.64.52.67 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"302e4a3aae0b72450430a1f7340003dc2156ccd8ead9ddf07e5f2d96dd379cfd"; reference:url,publicmosaic.com/indicators; sid:9105346; rev:2;)
alert tls $HOME_NET any -> 51.75.62.52 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ee99fb52abe75be69ea7ac7825e4b5765e1b037908237983111c143b2b695683"; reference:url,publicmosaic.com/indicators; sid:9100715; rev:2;)
alert tls $HOME_NET any -> 62.60.159.153 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"96dd1e712815426e89925a0184a06f0c5ca7428d7a1ff08c11b27235d065077d"; reference:url,publicmosaic.com/indicators; sid:9104232; rev:2;)
alert tls $HOME_NET any -> 62.76.229.144 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b6188a5f9c7f03e30dc42a1d23744cd767f2766989b2341b62ffd5f1203fd95c"; reference:url,publicmosaic.com/indicators; sid:9104236; rev:2;)
alert tls $HOME_NET any -> 64.23.254.205 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c19c15a70711482722723913180d67e3e984aba6bdbf6a4063ba468bde68f8ee"; reference:url,publicmosaic.com/indicators; sid:9104219; rev:2;)
alert tls $HOME_NET any -> 64.23.254.205 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c19c15a70711482722723913180d67e3e984aba6bdbf6a4063ba468bde68f8ee"; reference:url,publicmosaic.com/indicators; sid:9103699; rev:2;)
alert tls $HOME_NET any -> 64.176.41.241 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6dbef7de82a9b3f1b278c3a0fc74d89172bf735d1744534665302d80af1db8b5"; reference:url,publicmosaic.com/indicators; sid:9105013; rev:2;)
alert tls $HOME_NET any -> 77.42.75.230 8444 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e477deebafd29dcfadb1f3c43902f8290476a9ceb255c71e2d61cb10fcb0f702"; reference:url,publicmosaic.com/indicators; sid:9104171; rev:2;)
alert tls $HOME_NET any -> 82.165.218.73 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"448110064a4c28954e0efc3cb196fd583855c94c039604e11dac2ce7697f709e"; reference:url,publicmosaic.com/indicators; sid:9104222; rev:2;)
alert tls $HOME_NET any -> 92.5.166.15 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ed6efc1b1901f05da36ba140ae8d82c8bebd2780bcebc8cfe4c64df3fec02720"; reference:url,publicmosaic.com/indicators; sid:9104192; rev:2;)
alert tls $HOME_NET any -> 92.242.164.31 5555 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"cc9c98e0182135c6fe013a5ff39c32bbc31c966e8fbf6c96fc71a070e3c525ce"; reference:url,publicmosaic.com/indicators; sid:9106449; rev:2;)
alert tls $HOME_NET any -> 95.142.37.234 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"afeaace117088af4710e78a8a1cc0da8c373fb173da86c41d35c26d1995815cd"; reference:url,publicmosaic.com/indicators; sid:9104187; rev:2;)
alert tls $HOME_NET any -> 95.142.37.234 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"afeaace117088af4710e78a8a1cc0da8c373fb173da86c41d35c26d1995815cd"; reference:url,publicmosaic.com/indicators; sid:9104186; rev:2;)
alert tls $HOME_NET any -> 101.132.66.50 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"58934a755591a8abaa425f7ada1cb02307466b81fa40f3d89c7ff3721ddb1f75"; reference:url,publicmosaic.com/indicators; sid:9104214; rev:2;)
alert tls $HOME_NET any -> 103.121.92.150 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4a7a5683884dcba19d6634c1e0ef0e13ed66e614b623d0301d18fe8fe9760bab"; reference:url,publicmosaic.com/indicators; sid:9104211; rev:2;)
alert tls $HOME_NET any -> 103.121.92.249 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bd4ada9c372c9dcc46b6501a109f1fd4181d236408c2ab07a3b11321b1f0f67f"; reference:url,publicmosaic.com/indicators; sid:9101713; rev:2;)
alert tls $HOME_NET any -> 103.242.12.143 80 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0c94f1104f673f3d049bc6e2a507e601a063234a7c1c6ff7fc3ec4bb9660c5b2"; reference:url,publicmosaic.com/indicators; sid:9100761; rev:2;)
alert tls $HOME_NET any -> 104.253.79.117 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f4de8da4e6bfa2e45f0440244bbe21554f7a432906a26714fa028f746225b77c"; reference:url,publicmosaic.com/indicators; sid:9104177; rev:2;)
alert tls $HOME_NET any -> 106.54.62.203 80 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9963b928dc1147cf7ee066e1e98ec9b7365158c06f44a8e326b79ab7c9227ce3"; reference:url,publicmosaic.com/indicators; sid:9100760; rev:2;)
alert tls $HOME_NET any -> 116.198.204.146 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f8d60c6d9a16c40758bd0a7561457888507b59289bacb6b9b2193e9a1121f219"; reference:url,publicmosaic.com/indicators; sid:9103980; rev:2;)
alert tls $HOME_NET any -> 121.4.43.2 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"dd005ea709c75822e093fb3cd798dbf035e8f7638a7d80c942e092ae11188392"; reference:url,publicmosaic.com/indicators; sid:9104962; rev:2;)
alert tls $HOME_NET any -> 121.78.127.232 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8154bbb0ea8142a42aee788388228632834e9ac40aa62ef2b58b476ae7140e98"; reference:url,publicmosaic.com/indicators; sid:9104220; rev:2;)
alert tls $HOME_NET any -> 124.220.16.198 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b342a79baba091455e044db5575196c6df606e5f5b6cea1e27e8c7934e418ed9"; reference:url,publicmosaic.com/indicators; sid:9103956; rev:2;)
alert tls $HOME_NET any -> 137.116.136.69 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c4f341eb6e84ea11ed4cf4d0b3e53cd0f0d42c6d974b25f379469ea58f7c3e52"; reference:url,publicmosaic.com/indicators; sid:9104059; rev:2;)
alert tls $HOME_NET any -> 139.162.1.199 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"15568d9a085fde7267f743484a6443b35734685f9517626991d491c44d3fe4fb"; reference:url,publicmosaic.com/indicators; sid:9101718; rev:2;)
alert tls $HOME_NET any -> 149.104.90.17 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3fe06d4c66c67bc09050e370aa14f352e8be7198ea6a0417fbe341e5b2b8ee67"; reference:url,publicmosaic.com/indicators; sid:9101717; rev:2;)
alert tls $HOME_NET any -> 153.75.82.143 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ec02bd371b0c9807ab7eb75aa9c0afb4859195f863fa0c50e6d00f99cbbe5ec8"; reference:url,publicmosaic.com/indicators; sid:9100759; rev:2;)
alert tls $HOME_NET any -> 172.245.195.202 8888 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3108086a3a2bfe17c51af752d289f537cbca2fd7868d89679e28b86e3878f996"; reference:url,publicmosaic.com/indicators; sid:9100754; rev:2;)