# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 106 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 000000000000_7c32fa18c13e_bf0f0589fc03 — https://publicmosaic.com/ja4x/000000000000_7c32fa18c13e_bf0f0589fc03
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 2
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 3.21.191.242 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f7577aa5210643bc9a26da3e9eb1c731a9586a3a83142ab19f0fed9b7e1c196f"; reference:url,publicmosaic.com/indicators; sid:9101915; rev:2;)
alert tls $HOME_NET any -> 4.154.203.165 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"40258b5ce1b9197fd0d48c1f2450dd3e554237487a1d4fd924c71680223668c1"; reference:url,publicmosaic.com/indicators; sid:9104239; rev:2;)
alert tls $HOME_NET any -> 8.219.149.222 8080 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"98c0a69bfd1583449e3dd71bbb451ff0ae9b9d5b57104a8b4512eda9416322cb"; reference:url,publicmosaic.com/indicators; sid:9101916; rev:2;)
alert tls $HOME_NET any -> 9.223.178.81 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"09098b56efce1ca0ea0770c709134223f38854fdff7d5fc294c843a86108a920"; reference:url,publicmosaic.com/indicators; sid:9101917; rev:2;)
alert tls $HOME_NET any -> 13.158.165.149 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"05bfcaf1f44f7ad6224cabe78670a3ee78c11e5692ef94b1f6bfa56d36e8404f"; reference:url,publicmosaic.com/indicators; sid:9101918; rev:2;)
alert tls $HOME_NET any -> 15.235.37.196 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b1e7e12d8294288b4d148ad79f17018b61ff3688ff5006c719d378ae321c7acf"; reference:url,publicmosaic.com/indicators; sid:9101919; rev:2;)
alert tls $HOME_NET any -> 18.136.148.19 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"0b5d7b8f19913a6aef5747f8c5afd932ab864b58c01da182938faf5900011a0e"; reference:url,publicmosaic.com/indicators; sid:9100785; rev:2;)
alert tls $HOME_NET any -> 18.141.182.223 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"384bd8719c6436599e2c9359ed029793ee6344a6c49b88dbb0cb510ab212560b"; reference:url,publicmosaic.com/indicators; sid:9101920; rev:2;)
alert tls $HOME_NET any -> 20.62.126.164 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"92c86d3721e7bc274f8d68cd69827fc49ecfc06336108ef8d0cd70cc5b6d50fd"; reference:url,publicmosaic.com/indicators; sid:9101921; rev:2;)
alert tls $HOME_NET any -> 35.240.178.188 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9604c6724d1f0ba1c38ba48d2bf48167339a1bc7ffde6177a41d494fc90fb391"; reference:url,publicmosaic.com/indicators; sid:9100718; rev:2;)
alert tls $HOME_NET any -> 39.107.53.141 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"30cef81dc47c66c3f07feed36449968eb610d773449a38b766212f8035e24ff2"; reference:url,publicmosaic.com/indicators; sid:9104074; rev:2;)
alert tls $HOME_NET any -> 43.136.93.81 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b81cd330745d48b2b907b35812060d2a72f22ec5877eb7c2a71f650eb14036eb"; reference:url,publicmosaic.com/indicators; sid:9106133; rev:2;)
alert tls $HOME_NET any -> 43.155.215.231 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ba62914971a0a901cce8a75fbea4c80007e388910a2dfd3e6a76bb90be7ccbdf"; reference:url,publicmosaic.com/indicators; sid:9103976; rev:2;)
alert tls $HOME_NET any -> 44.200.237.10 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3da223e09c2308ab1c8d431d2b01f9e0ecf998676ef1d7e24f59503610915222"; reference:url,publicmosaic.com/indicators; sid:9101922; rev:2;)
alert tls $HOME_NET any -> 45.38.20.151 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"71bf5f878553803ff5a97d64bec87f661d1fc56f09fe569ac207e4ee8fd3c97f"; reference:url,publicmosaic.com/indicators; sid:9106347; rev:2;)
alert tls $HOME_NET any -> 45.74.31.54 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4d2ecd380840c1938a0ece01514b3ef0e9fa37ec33fe10a5afce27385a3b26a9"; reference:url,publicmosaic.com/indicators; sid:9100717; rev:2;)
alert tls $HOME_NET any -> 45.77.33.208 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b3d8b2241b869203e7dc75cf32dac694c559c2c16ac266458060c84355a3ee5a"; reference:url,publicmosaic.com/indicators; sid:9101923; rev:2;)
alert tls $HOME_NET any -> 45.87.245.85 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d154f770a23e049bd735656d402cdbda107e25d2a11cca655f13468a5e0a34fd"; reference:url,publicmosaic.com/indicators; sid:9101924; rev:2;)
alert tls $HOME_NET any -> 45.137.149.43 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"36b89d1353d62a64df511daa8bc38c69780a00408f5e56106ee64ab4c964ecd8"; reference:url,publicmosaic.com/indicators; sid:9105145; rev:2;)
alert tls $HOME_NET any -> 45.141.215.195 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6a801f71cca33673f6002b0d88ed7c41b6ea4c9fc08810cc992a979f2465693e"; reference:url,publicmosaic.com/indicators; sid:9100773; rev:2;)
alert tls $HOME_NET any -> 45.142.143.176 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f3079f3c8841f6dd06b44434fc5d198c19855ab3e48d6e86da3315a23aa9f6c1"; reference:url,publicmosaic.com/indicators; sid:9100772; rev:2;)
alert tls $HOME_NET any -> 45.154.98.226 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6c53ea0bc7f6866252003bdb0e0b606a6e11f01d233b1bc393399ab7e3922780"; reference:url,publicmosaic.com/indicators; sid:9106748; rev:2;)
alert tls $HOME_NET any -> 45.156.248.2 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4c88988b92684afc18b38c79d807dba0601a65848ae8cc94231e8bd6e645c8d9"; reference:url,publicmosaic.com/indicators; sid:9101925; rev:2;)
alert tls $HOME_NET any -> 46.151.182.182 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4e98f61b5d6a53e6870486f24d70f260bd8728381932cc1ba42d95bbf141c6c8"; reference:url,publicmosaic.com/indicators; sid:9104696; rev:2;)
alert tls $HOME_NET any -> 47.105.109.104 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"471e41900a65fbee890ccb574212b3bfeee7c960710405ab22e8501fedd220d3"; reference:url,publicmosaic.com/indicators; sid:9101926; rev:2;)
alert tls $HOME_NET any -> 47.110.42.209 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9ad9d14bb508099a22ad7ee05066ac946f88c2fd8abe5c3e7dac49ebbc028d2c"; reference:url,publicmosaic.com/indicators; sid:9101927; rev:2;)
alert tls $HOME_NET any -> 47.110.42.209 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f203293d02e06aa42e8d60f4d9870921f8f24f13e9986f838b252d4da934a010"; reference:url,publicmosaic.com/indicators; sid:9104458; rev:2;)
alert tls $HOME_NET any -> 47.237.100.236 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1b86134d2e23de8018192dfd1e13caff230007bea5b0e198437ec7849f8640a2"; reference:url,publicmosaic.com/indicators; sid:9100716; rev:2;)
alert tls $HOME_NET any -> 47.239.116.237 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9d23f3e9b08a184a67ed7b93364fb13bcfc199702704921dbb05a59b893255a1"; reference:url,publicmosaic.com/indicators; sid:9106011; rev:2;)
alert tls $HOME_NET any -> 51.81.63.109 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"899eb351331ebdcfaeac4aafb4b40a7b1e5602e57108a7f8faacb8de3fc196b9"; reference:url,publicmosaic.com/indicators; sid:9101928; rev:2;)
alert tls $HOME_NET any -> 51.81.80.239 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"899eb351331ebdcfaeac4aafb4b40a7b1e5602e57108a7f8faacb8de3fc196b9"; reference:url,publicmosaic.com/indicators; sid:9101929; rev:2;)
alert tls $HOME_NET any -> 52.51.21.68 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"da19ff4239ad3dbf0733c9ce8da5f1d9e07feea532fac21b89f3c1be1138f8c0"; reference:url,publicmosaic.com/indicators; sid:9104224; rev:2;)
alert tls $HOME_NET any -> 52.188.156.51 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2ddeb6ddeab66e1849ce2102ebcc864259d9228177359bf49a2ae40f29da9e5b"; reference:url,publicmosaic.com/indicators; sid:9101930; rev:2;)
alert tls $HOME_NET any -> 62.60.159.153 8099 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"bd792f422061530ac7bf9d8b4a2feadd96ff54dcc1465bbd4c9089b54253252b"; reference:url,publicmosaic.com/indicators; sid:9101931; rev:2;)
alert tls $HOME_NET any -> 62.76.229.144 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"6f52515b2cdd17e5e691457467c970249fd46fea0738b0a87290961737f7f9eb"; reference:url,publicmosaic.com/indicators; sid:9101932; rev:2;)
alert tls $HOME_NET any -> 64.23.192.235 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"a7ed9201558859d7859001f841cb55a08c23dfd10aa896bfff3eace2841c3571"; reference:url,publicmosaic.com/indicators; sid:9100713; rev:2;)
alert tls $HOME_NET any -> 64.176.41.241 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"44856a76d6076bbec85dcdff8e770142c90063e773eda8f28af7e1cd15220889"; reference:url,publicmosaic.com/indicators; sid:9100714; rev:2;)
alert tls $HOME_NET any -> 64.176.41.241 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c4ae080324ba02158cba6ad48d3af6d63e6330c42dadbc509618d4da5160b4af"; reference:url,publicmosaic.com/indicators; sid:9100795; rev:2;)
alert tls $HOME_NET any -> 64.235.35.39 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1c25174752ff8134cca154b045ee41afd5ab09df11d540465e6e2f05f368ebfb"; reference:url,publicmosaic.com/indicators; sid:9100794; rev:2;)
alert tls $HOME_NET any -> 65.20.69.106 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c6b7093c6d350fcec236e86a479edcc3819a5fab5883189975baa307b634df59"; reference:url,publicmosaic.com/indicators; sid:9101933; rev:2;)
alert tls $HOME_NET any -> 77.42.75.230 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"28ac7c465c115bf51b02a774e04e3896a09991fb0eae73116e6af760e30c6256"; reference:url,publicmosaic.com/indicators; sid:9101934; rev:2;)
alert tls $HOME_NET any -> 77.42.75.230 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"368ddd548ac9e3ec5ccc94bf68be58aa9a710bdf4c28294e638a184817f321c1"; reference:url,publicmosaic.com/indicators; sid:9104170; rev:2;)
alert tls $HOME_NET any -> 78.17.212.192 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"50c3179305e7c1ed2565838e0bad8a13e505e68b728f824e21313dfc638e82a6"; reference:url,publicmosaic.com/indicators; sid:9101935; rev:2;)
alert tls $HOME_NET any -> 79.137.77.63 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"985fb8bdf4ca11e99e94d491bcd909f6aaec0ea53d4535b54ad15a5c40dce3aa"; reference:url,publicmosaic.com/indicators; sid:9105342; rev:2;)
alert tls $HOME_NET any -> 80.94.93.47 9823 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c4758e6a2cdd8143bf774e611dbdc9027dddf32c66cbc1c3aee12a90cdaa562e"; reference:url,publicmosaic.com/indicators; sid:9101936; rev:2;)
alert tls $HOME_NET any -> 87.120.92.91 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"68434b7aec1fd39b41a3c0ee0355ed9e43e6407056f7779d441ffba14171b626"; reference:url,publicmosaic.com/indicators; sid:9101937; rev:2;)
alert tls $HOME_NET any -> 91.199.154.103 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8981285f37fb0cf81a4ab9301a93acace4e43574f0b2542bce0f6a283545a98a"; reference:url,publicmosaic.com/indicators; sid:9101710; rev:2;)
alert tls $HOME_NET any -> 92.63.104.14 9443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e6754111d19f1a7fb1f32db8f4a7e91d145da8e2621a657ca274f074ca872e7f"; reference:url,publicmosaic.com/indicators; sid:9101938; rev:2;)
alert tls $HOME_NET any -> 92.242.164.31 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3a6318f64860cb8c1878e23fb8bf9b31a8631ca7f8a83ee41cefaadc545b9148"; reference:url,publicmosaic.com/indicators; sid:9101939; rev:2;)
alert tls $HOME_NET any -> 92.242.164.31 4433 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"05df1766bb7036f534a61207db6629cda335f09e2b0ec0a89f6423c9f1a1e747"; reference:url,publicmosaic.com/indicators; sid:9106450; rev:2;)
alert tls $HOME_NET any -> 94.125.101.85 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d17cc653329b5518b96d650b272e595c4fe4ee287b463b7f343fe1d4e4cd69dc"; reference:url,publicmosaic.com/indicators; sid:9106198; rev:2;)
alert tls $HOME_NET any -> 95.142.37.234 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c053713a26655918eaa63aa729e37335f47f74ae8415ab533b67a642eb6c7dde"; reference:url,publicmosaic.com/indicators; sid:9101940; rev:2;)
alert tls $HOME_NET any -> 101.42.96.140 8889 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b5d7a7d4e570aab0baa278c4a576c7b79760b7987a4073d5641580be3e3a8275"; reference:url,publicmosaic.com/indicators; sid:9101942; rev:2;)
alert tls $HOME_NET any -> 101.126.90.250 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4e59a6b573526fc1c14dd863d6d76ed96cc17ac0273ca3d097a66aa43e7b9c27"; reference:url,publicmosaic.com/indicators; sid:9101716; rev:2;)
alert tls $HOME_NET any -> 101.132.66.50 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9b4276f70fd0d951695d02846fe86c3686d7239ba90a985b205cd517ff218e7d"; reference:url,publicmosaic.com/indicators; sid:9104213; rev:2;)
alert tls $HOME_NET any -> 103.250.172.230 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"713316dfa832c897699c79806bb1526e4b9448cf40a41c3416883bd0a148d211"; reference:url,publicmosaic.com/indicators; sid:9106210; rev:2;)
alert tls $HOME_NET any -> 104.248.229.157 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"687c96413eac5cba6950bd966a7545739530e8613b98b110fc9bce2e2df0ed20"; reference:url,publicmosaic.com/indicators; sid:9101943; rev:2;)
alert tls $HOME_NET any -> 107.23.60.48 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4ea7f45313aa7ca5ef231cf78a1451e9dcf3ef0717795169f4c94b6b6b7e5b27"; reference:url,publicmosaic.com/indicators; sid:9101944; rev:2;)
alert tls $HOME_NET any -> 114.55.151.60 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"21122a428605b3696f6804e609ed6f6f7e1e697eab07b1406b25ba1760e34dc1"; reference:url,publicmosaic.com/indicators; sid:9101947; rev:2;)
alert tls $HOME_NET any -> 115.190.227.197 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ed31a9ab9209f1a2a07ac20ab6a34a708b0dbfa4b5318b9053fd387404c7f3c8"; reference:url,publicmosaic.com/indicators; sid:9103957; rev:2;)
alert tls $HOME_NET any -> 118.195.163.227 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d55457fe50519b02116dde7cd761ba5f327b5f05a374920c4b857115f3233682"; reference:url,publicmosaic.com/indicators; sid:9106800; rev:2;)
alert tls $HOME_NET any -> 124.158.5.149 9001 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c38a723dca9439f47011d2fd7ba0d0ccebb2b6bf2a5442ab1a0d845a526dec7d"; reference:url,publicmosaic.com/indicators; sid:9100729; rev:2;)
alert tls $HOME_NET any -> 124.158.5.149 9003 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"efc61ac332c99b5cf0792aefc8360255bcaa95e72b56bb94b4f58620e49c9569"; reference:url,publicmosaic.com/indicators; sid:9103646; rev:2;)
alert tls $HOME_NET any -> 129.213.164.210 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d34d45be274b9e23d11cf10a18c0dd1414efe7e5a45c852e6cbdbe9636fd7487"; reference:url,publicmosaic.com/indicators; sid:9101948; rev:2;)
alert tls $HOME_NET any -> 134.122.153.121 8080 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"253eb7154b2ebd6c89c962d87845d0b04b1f19cc93524f345e0bd3ae864cf459"; reference:url,publicmosaic.com/indicators; sid:9103977; rev:2;)
alert tls $HOME_NET any -> 134.209.213.17 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2e02d72d464625280fa7097e5f559f7049293e87a0d74581709aa1400d7b0ed9"; reference:url,publicmosaic.com/indicators; sid:9101973; rev:2;)
alert tls $HOME_NET any -> 135.106.164.201 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"b33c5639d5179931eda063e9cc47a097baa9c8fe047cdc4befd0072c5a04b5a8"; reference:url,publicmosaic.com/indicators; sid:9101972; rev:2;)
alert tls $HOME_NET any -> 138.91.32.183 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d5a01d6b9667e1303c71a89caa5aa8d5f66665d81be7ee4ac7c8c37da734a4bb"; reference:url,publicmosaic.com/indicators; sid:9102248; rev:2;)
alert tls $HOME_NET any -> 138.226.222.47 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9e07f646bb448a1e384e5615aa07603f43c4524396ce47cb87e8011924bbfac0"; reference:url,publicmosaic.com/indicators; sid:9101971; rev:2;)
alert tls $HOME_NET any -> 142.91.109.153 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9179c56fa7fff5e8c4341058529dba9a76d3e8413ea49fba626a3bef38431a55"; reference:url,publicmosaic.com/indicators; sid:9100853; rev:2;)
alert tls $HOME_NET any -> 142.93.162.87 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9f51e1b13460a633ad8b6ce6a414c18c190698e7c92778ce8b59aad507e6907e"; reference:url,publicmosaic.com/indicators; sid:9105336; rev:2;)
alert tls $HOME_NET any -> 142.93.162.87 8080 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4d37cae74b91bd1e85eb9f37d88e7353f3f275c7f9bbd1af3dfc0382dfdf1352"; reference:url,publicmosaic.com/indicators; sid:9106010; rev:2;)
alert tls $HOME_NET any -> 143.198.149.226 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d899c7d0b407118534bb61a7aeff368df39db5a13fa04ad6a7d0f2f027d0eaea"; reference:url,publicmosaic.com/indicators; sid:9104972; rev:2;)
alert tls $HOME_NET any -> 144.126.210.142 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8c00100c9d554771d2298441edd1fe630b408baa4942f6257e4f571f24dadd91"; reference:url,publicmosaic.com/indicators; sid:9104238; rev:2;)
alert tls $HOME_NET any -> 145.239.73.139 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"42d5f695e7a95050d5bb6b355004d8dcde8ebeab71ea5f9da9dbec187310d9af"; reference:url,publicmosaic.com/indicators; sid:9106009; rev:2;)
alert tls $HOME_NET any -> 146.59.63.41 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9fd4199d09d74413b0e91d093b7d85ebadbab79bb1dc56acfc36bef2e206ddce"; reference:url,publicmosaic.com/indicators; sid:9106745; rev:2;)
alert tls $HOME_NET any -> 146.70.79.45 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"81df444929628e5c96c6ffbe18f59de7015747cb20663857b4bd4658cea4baad"; reference:url,publicmosaic.com/indicators; sid:9104237; rev:2;)
alert tls $HOME_NET any -> 146.70.158.198 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"55b294b42b6b91d6de116c6f60f2cf4e77f9571aea2b4e5bc5c827a9f0b9d3d8"; reference:url,publicmosaic.com/indicators; sid:9100797; rev:2;)
alert tls $HOME_NET any -> 146.70.232.107 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ad9af8c056757580586667da76ade7b3bb043d41aaf4361b55d1252ff4b4d487"; reference:url,publicmosaic.com/indicators; sid:9106744; rev:2;)
alert tls $HOME_NET any -> 150.107.31.116 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9de5393fab1875d2c1320e3cfb88ca8ec1fc3710d7b6b12bf8376bd99401853e"; reference:url,publicmosaic.com/indicators; sid:9100712; rev:2;)
alert tls $HOME_NET any -> 151.243.126.22 2053 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9087854b9e6c9a0500ae6b03a1276be38c81eaa1100775e99ea0697546afb7fd"; reference:url,publicmosaic.com/indicators; sid:9106207; rev:2;)
alert tls $HOME_NET any -> 152.42.214.0 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d9bc1819ddfa812f0728c67d2ce9ca6f89ce0dbb095133f0233cf9ca20f33d7a"; reference:url,publicmosaic.com/indicators; sid:9101970; rev:2;)
alert tls $HOME_NET any -> 152.42.214.0 4443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"c08168d8d128202ea9f29334d416020fdc409969898928e3d1ea249fd7ef2935"; reference:url,publicmosaic.com/indicators; sid:9101969; rev:2;)
alert tls $HOME_NET any -> 153.76.114.134 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4ab458ed8db2dcba3aa40d641d04e683c12eb128c8cc366fcf3a82db783a947f"; reference:url,publicmosaic.com/indicators; sid:9104935; rev:2;)
alert tls $HOME_NET any -> 155.138.148.143 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"3e433cd6dbfabb90429aa7b1e0e05fbb36df9f0fc866357afeed3831223c53c2"; reference:url,publicmosaic.com/indicators; sid:9101968; rev:2;)
alert tls $HOME_NET any -> 157.245.14.84 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"dd75e5acd8fff52d99dbf0f6dc00c1b8b13e115d74b9f992d29f2957690ecff5"; reference:url,publicmosaic.com/indicators; sid:9100711; rev:2;)
alert tls $HOME_NET any -> 158.94.208.154 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"f0702a4c53a1e1afc15b177a917a692056adc9ec6d3293bf4e9811d0f6f60782"; reference:url,publicmosaic.com/indicators; sid:9101967; rev:2;)
alert tls $HOME_NET any -> 159.65.113.187 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8c5d4b00f726f466a88b579de0d2a1864a1353384a9eb3994ec32f6d790467b4"; reference:url,publicmosaic.com/indicators; sid:9100708; rev:2;)
alert tls $HOME_NET any -> 159.223.138.182 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"628b696f74547c632b4e941895095ea5afa396e4b7842e58ef5c1e1677567f84"; reference:url,publicmosaic.com/indicators; sid:9101966; rev:2;)
alert tls $HOME_NET any -> 162.254.35.170 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9215bdf922d2c01684c0d7df3b7b086af4a68fec4f1f32bf22196b9a1c6f5c5f"; reference:url,publicmosaic.com/indicators; sid:9100709; rev:2;)
alert tls $HOME_NET any -> 164.90.149.44 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9facf4cb0f60860863e8767e83331f830e6182a983f79b756f0b857af1f140f1"; reference:url,publicmosaic.com/indicators; sid:9100707; rev:2;)
alert tls $HOME_NET any -> 164.90.201.1 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"1bbf707f6664764bb8ade66097afd9ab433ae5b976e7b9e5bc930c2a98b0072a"; reference:url,publicmosaic.com/indicators; sid:9101965; rev:2;)
alert tls $HOME_NET any -> 167.71.13.103 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5eeb3cffe5dfe3b4f601162436a1d66c32ac59d62527907a99bc89c39a53259f"; reference:url,publicmosaic.com/indicators; sid:9100705; rev:2;)
alert tls $HOME_NET any -> 167.99.5.39 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"ce845333d39c1187778b5873cc6c5bfd17ca206a1f0c1efd1a1fcc147796f6e8"; reference:url,publicmosaic.com/indicators; sid:9100704; rev:2;)
alert tls $HOME_NET any -> 178.104.123.237 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"d01413aebc25a90ad541ad4f942ab257996caaef5a2de5c9dee2d168e9630e4f"; reference:url,publicmosaic.com/indicators; sid:9101964; rev:2;)
alert tls $HOME_NET any -> 178.128.21.54 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"25f70c6d4330f59e04e07c1d2614e9d0e4ed4a8a778d2215f4019c0fe837228c"; reference:url,publicmosaic.com/indicators; sid:9101963; rev:2;)
alert tls $HOME_NET any -> 182.255.45.50 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"4bd148c5c8b0e49686503b355e1083bc23d3184f70135ce9424c0c7fef10c6fb"; reference:url,publicmosaic.com/indicators; sid:9100703; rev:2;)
alert tls $HOME_NET any -> 182.255.91.104 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8c0600b76e7a6c5044790a8ac3df214963de4ada003cae498b00509c6d373741"; reference:url,publicmosaic.com/indicators; sid:9100164; rev:2;)
alert tls $HOME_NET any -> 192.30.243.157 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"2ff4902228ca6c5c9961f1965e0991cad2f63be56e4607ce10a04032035ce31f"; reference:url,publicmosaic.com/indicators; sid:9101961; rev:2;)
alert tls $HOME_NET any -> 194.87.206.229 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"8981285f37fb0cf81a4ab9301a93acace4e43574f0b2542bce0f6a283545a98a"; reference:url,publicmosaic.com/indicators; sid:9101960; rev:2;)
alert tls $HOME_NET any -> 202.61.137.217 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"5c1b750bfc6caa351911ab89412e296346e10d5d3c43d73944c70285c502efc8"; reference:url,publicmosaic.com/indicators; sid:9101959; rev:2;)
alert tls $HOME_NET any -> 203.88.118.192 8443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"369fed3706977c877ce080a2a32dfbdf60b41c181435744accdab3e114c4bfbd"; reference:url,publicmosaic.com/indicators; sid:9101958; rev:2;)
alert tls $HOME_NET any -> 203.159.90.207 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"92fb046b5d6357a0108ef8ff593341781a3002bb2f3fb07a86afef84221a9be2"; reference:url,publicmosaic.com/indicators; sid:9100753; rev:2;)
alert tls $HOME_NET any -> 207.57.135.209 4443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"9c4f713a3bb89a9e7cdd52e0d7a2f6d07a86eed6405abf8fab44be704a6da67e"; reference:url,publicmosaic.com/indicators; sid:9100793; rev:2;)
alert tls $HOME_NET any -> 213.165.60.71 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"615bf35b3a8f82fd2ab542f075d60246762f380d0007aaa5b6e672ec6cd4b704"; reference:url,publicmosaic.com/indicators; sid:9101957; rev:2;)
alert tls $HOME_NET any -> 213.183.56.126 443 (msg:"HOLLOWPOINT C2 sliver"; tls.cert_fingerprint; content:"e072a7c912b9ff9f490cc2d212f89c61776a5e417b8c8d1ef85dae45f2513f29"; reference:url,publicmosaic.com/indicators; sid:9101956; rev:2;)