# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 52 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 0b479b1b5763_0b479b1b5763_e9d2b55797df — https://publicmosaic.com/ja4x/0b479b1b5763_0b479b1b5763_e9d2b55797df
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 5.175.182.184 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a7dc431180e155cf3e1427171d829e0ccb257f5f7a02c941114e1dd1fdaca368"; reference:url,publicmosaic.com/indicators; sid:9101588; rev:2;)
alert tls $HOME_NET any -> 13.205.246.212 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e7987fdd4a790d1e28293f93b21ee30159e255b59aff1001ba0bef3832ad65a7"; reference:url,publicmosaic.com/indicators; sid:9101560; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fd9da0342e433f4b9ba85d1b617a325cd9b658a5a8ea0b7810a29d4a1678d256"; reference:url,publicmosaic.com/indicators; sid:9101250; rev:2;)
alert tls $HOME_NET any -> 27.124.36.136 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e70b610e05a47723602104c3315f513798f2d84e165c96ddc383d8bf665651d"; reference:url,publicmosaic.com/indicators; sid:9101559; rev:2;)
alert tls $HOME_NET any -> 27.124.36.151 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e70b610e05a47723602104c3315f513798f2d84e165c96ddc383d8bf665651d"; reference:url,publicmosaic.com/indicators; sid:9101551; rev:2;)
alert tls $HOME_NET any -> 31.57.38.7 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"6c2f3547c0285f4a25eb3fa79f7479dd89a6e6cfb27f7aa5f12447979fa79fed"; reference:url,publicmosaic.com/indicators; sid:9101321; rev:2;)
alert tls $HOME_NET any -> 31.76.125.10 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"5ac9795c24d7114fac1dcbd58e9a8e35a86c9a0daa6eb960049cd5fbb47ec735"; reference:url,publicmosaic.com/indicators; sid:9101750; rev:2;)
alert tls $HOME_NET any -> 38.240.48.155 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"30b227a2b7f36040f67a3851f2b5de331b6e6241e910c414a3a4e6aa760b8599"; reference:url,publicmosaic.com/indicators; sid:9101277; rev:2;)
alert tls $HOME_NET any -> 38.240.57.198 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c6fe42595f5b0a97dc4c7623ab48ed5ad5f10febac0aeed00835be7a423afbf1"; reference:url,publicmosaic.com/indicators; sid:9101549; rev:2;)
alert tls $HOME_NET any -> 43.135.26.173 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"9f904b1aef85ae53cf55bcfff4e1b8b20e2708156e075d1922b2e5528372c9f9"; reference:url,publicmosaic.com/indicators; sid:9101558; rev:2;)
alert tls $HOME_NET any -> 45.9.12.6 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"44b742f440956a0d6aa87fd3efc672462d3e85667f16706706385722d86c1ff1"; reference:url,publicmosaic.com/indicators; sid:9101249; rev:2;)
alert tls $HOME_NET any -> 45.139.104.26 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"cec2240638f946f07575c857f2b616d3859203ea308e52bca8618010d5e0e579"; reference:url,publicmosaic.com/indicators; sid:9106832; rev:2;)
alert tls $HOME_NET any -> 45.139.104.204 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"88cc822004271b517410718f9352af88d65feb760a8f5d5fa53a4847b2c0ef0a"; reference:url,publicmosaic.com/indicators; sid:9105816; rev:2;)
alert tls $HOME_NET any -> 45.139.104.226 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1d3ad35b189a89c1095e0a3e710204b603ef3efa942e93f413a314d904c90307"; reference:url,publicmosaic.com/indicators; sid:9104685; rev:2;)
alert tls $HOME_NET any -> 45.149.153.23 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f23699e931169efa2fc830510dc356bc1a7953903538fef6b8508d73a86a4f38"; reference:url,publicmosaic.com/indicators; sid:9101557; rev:2;)
alert tls $HOME_NET any -> 51.79.169.74 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"183617c661031ff658c324e9695e63c48a5ac0776f607717ce4d50aef35bd102"; reference:url,publicmosaic.com/indicators; sid:9101556; rev:2;)
alert tls $HOME_NET any -> 65.1.70.222 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"2fb1c213ec4dd6f2a63ecf3d3d300e056142872db89da0c361640602f2849b95"; reference:url,publicmosaic.com/indicators; sid:9101248; rev:2;)
alert tls $HOME_NET any -> 80.96.109.107 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a3178e2eb85f30f2065d7f014a88192c7b9cbe5ff7c21f8d44e90b0ffc63ec70"; reference:url,publicmosaic.com/indicators; sid:9101555; rev:2;)
alert tls $HOME_NET any -> 83.136.211.230 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0fe191a35af005d19fa6b9e257e3116e9f84227afa8a49b969e4e288b6ffe200"; reference:url,publicmosaic.com/indicators; sid:9105815; rev:2;)
alert tls $HOME_NET any -> 84.201.20.74 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"44e8cd1d92caa289781f5b9b7a7dc6993f4fd8cfae729d193b6685f4c7227767"; reference:url,publicmosaic.com/indicators; sid:9101554; rev:2;)
alert tls $HOME_NET any -> 91.92.40.209 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"010ada05fc48381615e3d71240853d36c22143b42c8b0f23cfa342b1cba309a8"; reference:url,publicmosaic.com/indicators; sid:9101288; rev:2;)
alert tls $HOME_NET any -> 91.219.239.100 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"14d65bb835dd1ee373290d1e2293dda4b76e1115b166a88d46c0e7f4ef31fcf7"; reference:url,publicmosaic.com/indicators; sid:9105126; rev:2;)
alert tls $HOME_NET any -> 94.143.231.61 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"67d32b82de0af1b80508098339e2385a5fa2dc62ef50718c79a17bc48d668ec5"; reference:url,publicmosaic.com/indicators; sid:9101552; rev:2;)
alert tls $HOME_NET any -> 95.133.229.173 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"bfc794ba655afc4e90d4209a0e1c29d02b00588a059d429e93c3676a5822e85c"; reference:url,publicmosaic.com/indicators; sid:9101246; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"63bfe77fd83ff334a9be0cfadb4912ab923d801a6ff0f0e54c63abd4e2bcd788"; reference:url,publicmosaic.com/indicators; sid:9101714; rev:2;)
alert tls $HOME_NET any -> 107.149.8.58 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"14ce09b7ce7c2445d37af4a0e979f1d140924180252415a87d527417b601f681"; reference:url,publicmosaic.com/indicators; sid:9105545; rev:2;)
alert tls $HOME_NET any -> 107.150.72.199 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"90c533364b293892c2b24c8b75871d9de1c61040725a249816b845e98b1f817f"; reference:url,publicmosaic.com/indicators; sid:9106469; rev:2;)
alert tls $HOME_NET any -> 108.59.244.106 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a2faa5fd368e7f70c2dbb296bec61988ca4d4eea72ce2b76f31a6099076b2ac8"; reference:url,publicmosaic.com/indicators; sid:9101743; rev:2;)
alert tls $HOME_NET any -> 130.12.182.209 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"5302cab2f9d10dcc497458d27d68febeb8f0254a657eac08f984b1bbee9a84b7"; reference:url,publicmosaic.com/indicators; sid:9101243; rev:2;)
alert tls $HOME_NET any -> 135.84.210.197 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"54aa6b7e3de7a9503a2ee0cdeec4c601bdfa5712efd7496dece7f2eeadd64907"; reference:url,publicmosaic.com/indicators; sid:9105811; rev:2;)
alert tls $HOME_NET any -> 135.136.147.86 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"86d47eb3aa48cc86a4ef10c35d4ff4f06073fc9abb93d82241163bf9a53fb57d"; reference:url,publicmosaic.com/indicators; sid:9101550; rev:2;)
alert tls $HOME_NET any -> 144.31.6.0 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3362b443a7a08bb5e9fb7d50656faae9955d321f60e006c403dd8f24c5259ac2"; reference:url,publicmosaic.com/indicators; sid:9101640; rev:2;)
alert tls $HOME_NET any -> 144.31.6.6 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"82be34eaea2d8b8e3b282002ecb882d9fc4c6c1fa790b8cb9ee3b4173e000c8f"; reference:url,publicmosaic.com/indicators; sid:9101335; rev:2;)
alert tls $HOME_NET any -> 144.31.6.21 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"9e184c9ccdd5133d25325cb5f9252a8de8864e4702c0a8a5fd93671e1678b725"; reference:url,publicmosaic.com/indicators; sid:9101287; rev:2;)
alert tls $HOME_NET any -> 144.172.112.126 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"5124da47575f119eb08488e54f896960a7662e89329d61df30b5b4fbfd3e2a18"; reference:url,publicmosaic.com/indicators; sid:9105814; rev:2;)
alert tls $HOME_NET any -> 158.94.211.158 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"39ba16f179f41d46df324d28c145fab29abb288bf3fb09270baf3ce724ab9686"; reference:url,publicmosaic.com/indicators; sid:9105813; rev:2;)
alert tls $HOME_NET any -> 172.81.132.75 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a53c65b5aa30d59a8cef7743b05a3adc4de374296251ebf4e697d7dfd94236c2"; reference:url,publicmosaic.com/indicators; sid:9101553; rev:2;)
alert tls $HOME_NET any -> 172.86.122.177 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"92653bf7b73322a4c4805f601adc31fae9c37d2fe9330606ede41d3516c5506b"; reference:url,publicmosaic.com/indicators; sid:9101329; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"29c4cb19385a4e410c03cec1a982527a09352afd2cf6bdd20c1e607d8ae1687b"; reference:url,publicmosaic.com/indicators; sid:9101242; rev:2;)
alert tls $HOME_NET any -> 178.211.155.154 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"0e5dad5b46de9afa31d9effe7e3e5b67d251ced9f66a595e15caec37b6bdb9c9"; reference:url,publicmosaic.com/indicators; sid:9101548; rev:2;)
alert tls $HOME_NET any -> 185.112.59.115 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ac956e6e99b48da03270a69d809bd13d90150391812527785a39118ede97bae7"; reference:url,publicmosaic.com/indicators; sid:9101518; rev:2;)
alert tls $HOME_NET any -> 185.174.102.5 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"59894e7c37cac9f0fa21ce41fbd7b9f2f247235dc14ed91af124e3a262924457"; reference:url,publicmosaic.com/indicators; sid:9105812; rev:2;)
alert tls $HOME_NET any -> 194.9.6.125 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5c7ce74a655bedb8cc15d2d809842cfa546bac3cfd5ba6000e06bc6d9f98724"; reference:url,publicmosaic.com/indicators; sid:9101239; rev:2;)
alert tls $HOME_NET any -> 194.62.248.129 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"6888b21a76b261e0d76b1b57a7435c95f0738ac992ad94044364b0aa77d4342d"; reference:url,publicmosaic.com/indicators; sid:9105810; rev:2;)
alert tls $HOME_NET any -> 199.231.191.3 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c64f6cc6be61f55d429456af05dc436956f353bf4d99bde0864d58550acc591e"; reference:url,publicmosaic.com/indicators; sid:9101567; rev:2;)
alert tls $HOME_NET any -> 202.155.9.186 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"706dab2df64822292b58d506cc5c1efc0b3c964970c3f24d9963d9743bd36235"; reference:url,publicmosaic.com/indicators; sid:9101325; rev:2;)
alert tls $HOME_NET any -> 203.159.90.177 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"269bc90b83c85ac50349794fa6a2a9a0ec1d0909ea87b2808a3fc6b13cd6fe3b"; reference:url,publicmosaic.com/indicators; sid:9101241; rev:2;)
alert tls $HOME_NET any -> 203.202.232.132 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fc3e249f91faee6fdbcb53a47242a045a5d8d5a1532b02fc4db29ce28fcdda4c"; reference:url,publicmosaic.com/indicators; sid:9101240; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"aae970e704d6970354b12c3f834b00f8d56d4857afa66886161d8017b95ea58b"; reference:url,publicmosaic.com/indicators; sid:9101470; rev:2;)
alert tls $HOME_NET any -> 217.60.195.139 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"47adc6a64c0a1250e177abcbff7b2004a0d83b1a787974086c15711d233b358f"; reference:url,publicmosaic.com/indicators; sid:9101238; rev:2;)
alert tls $HOME_NET any -> 217.60.195.193 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f4be79a934eececfb72d0d2252478b2d1272d77343ea065c55bf902c3d4482ba"; reference:url,publicmosaic.com/indicators; sid:9104161; rev:2;)
alert tls $HOME_NET any -> 217.60.195.226 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"04ed4773b612b28ee230eae5e973803354488ea22a7fa31f15408694c80d14b6"; reference:url,publicmosaic.com/indicators; sid:9104160; rev:2;)