# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 44 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 2166164053c1_2166164053c1_000000000000 — https://publicmosaic.com/ja4x/2166164053c1_2166164053c1_000000000000
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 8.138.179.29 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102247; rev:2;)
alert tls $HOME_NET any -> 14.116.159.128 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102246; rev:2;)
alert tls $HOME_NET any -> 23.88.110.42 8443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"a5e6524dbdb776c72eb6cc5c26947800923ab56c3050722ac05ba54193f4caef"; reference:url,publicmosaic.com/indicators; sid:9100515; rev:2;)
alert tls $HOME_NET any -> 23.94.27.110 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9103802; rev:2;)
alert tls $HOME_NET any -> 43.143.94.53 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102245; rev:2;)
alert tls $HOME_NET any -> 43.153.171.132 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102243; rev:2;)
alert tls $HOME_NET any -> 43.164.191.203 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102242; rev:2;)
alert tls $HOME_NET any -> 45.192.105.141 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9101201; rev:2;)
alert tls $HOME_NET any -> 47.86.97.42 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102241; rev:2;)
alert tls $HOME_NET any -> 47.94.13.0 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9103801; rev:2;)
alert tls $HOME_NET any -> 47.108.140.10 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102240; rev:2;)
alert tls $HOME_NET any -> 49.235.130.208 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100872; rev:2;)
alert tls $HOME_NET any -> 60.205.115.92 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102239; rev:2;)
alert tls $HOME_NET any -> 67.216.197.83 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9103800; rev:2;)
alert tls $HOME_NET any -> 82.156.166.227 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9103966; rev:2;)
alert tls $HOME_NET any -> 85.137.240.26 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102237; rev:2;)
alert tls $HOME_NET any -> 101.34.222.38 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102236; rev:2;)
alert tls $HOME_NET any -> 103.39.79.102 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102235; rev:2;)
alert tls $HOME_NET any -> 103.142.147.17 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102234; rev:2;)
alert tls $HOME_NET any -> 103.215.81.156 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9104542; rev:2;)
alert tls $HOME_NET any -> 103.236.69.102 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102233; rev:2;)
alert tls $HOME_NET any -> 104.225.149.151 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102232; rev:2;)
alert tls $HOME_NET any -> 106.52.255.211 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102231; rev:2;)
alert tls $HOME_NET any -> 106.54.41.209 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100873; rev:2;)
alert tls $HOME_NET any -> 111.170.148.132 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100732; rev:2;)
alert tls $HOME_NET any -> 111.170.148.134 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102230; rev:2;)
alert tls $HOME_NET any -> 111.230.143.136 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9101342; rev:2;)
alert tls $HOME_NET any -> 113.44.89.87 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100731; rev:2;)
alert tls $HOME_NET any -> 113.44.90.0 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9100730; rev:2;)
alert tls $HOME_NET any -> 117.72.32.75 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102229; rev:2;)
alert tls $HOME_NET any -> 122.51.215.90 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102228; rev:2;)
alert tls $HOME_NET any -> 124.220.161.214 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102227; rev:2;)
alert tls $HOME_NET any -> 137.184.139.185 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"ae6f95692b2dfa9d33349dc1b80aa8dbed27d0288434bf886b657c8cf019fea9"; reference:url,publicmosaic.com/indicators; sid:9104518; rev:2;)
alert tls $HOME_NET any -> 139.212.143.218 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102226; rev:2;)
alert tls $HOME_NET any -> 152.32.133.192 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9106389; rev:2;)
alert tls $HOME_NET any -> 152.42.185.244 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102225; rev:2;)
alert tls $HOME_NET any -> 154.219.105.134 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102224; rev:2;)
alert tls $HOME_NET any -> 159.223.145.166 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"eb86685564408ce5cccaca9c159b60a899add2417da0c50b20d4a4eeb52e61eb"; reference:url,publicmosaic.com/indicators; sid:9104517; rev:2;)
alert tls $HOME_NET any -> 176.120.22.127 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"7a61d918721e17895fd89ab3ca36dbb7db81436ae514bc8405103940f47de666"; reference:url,publicmosaic.com/indicators; sid:9103331; rev:2;)
alert tls $HOME_NET any -> 176.120.22.129 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"8e8c620ba17d92e20ca36c36e514271d54b3a48e42e728ec4b7a891e30bea17d"; reference:url,publicmosaic.com/indicators; sid:9104833; rev:2;)
alert tls $HOME_NET any -> 180.101.25.48 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102223; rev:2;)
alert tls $HOME_NET any -> 192.144.211.249 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102222; rev:2;)
alert tls $HOME_NET any -> 203.195.217.161 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102221; rev:2;)
alert tls $HOME_NET any -> 208.87.201.226 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"4de3278507c89d2242a12c20b74878e3f84970c463a924771f156a3da7d7b5a1"; reference:url,publicmosaic.com/indicators; sid:9102220; rev:2;)