# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 12 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 2166164053c1_2166164053c1_795797892f9c — https://publicmosaic.com/ja4x/2166164053c1_2166164053c1_795797892f9c
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 1.92.135.168 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"a598b57d3b276a021f2c0867654c92b886f4a1e7f3e1d8149ea90a7dc6b48cab"; reference:url,publicmosaic.com/indicators; sid:9102211; rev:2;)
alert tls $HOME_NET any -> 13.236.153.60 443 (msg:"HOLLOWPOINT C2 poshc2"; tls.cert_fingerprint; content:"28817b11b5bf3fcacd0f64965caaee682f7baf9524caa44dfd523aefcee0b269"; reference:url,publicmosaic.com/indicators; sid:9100516; rev:2;)
alert tls $HOME_NET any -> 23.148.212.254 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"12033c3063b2a5b1fa63959a65362cf7a8b70784d8221b3b879b7b3264479284"; reference:url,publicmosaic.com/indicators; sid:9105293; rev:2;)
alert tls $HOME_NET any -> 43.143.234.164 60000 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"83f9b6f62066807dd3301ec66d112b156978e65e51e7202d9093071c4dc23b09"; reference:url,publicmosaic.com/indicators; sid:9102244; rev:2;)
alert tls $HOME_NET any -> 45.94.31.227 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"514887edd38662a3fcfe717d04e0c688e5dde95c618f572c7d6b2845c618c38a"; reference:url,publicmosaic.com/indicators; sid:9101589; rev:2;)
alert tls $HOME_NET any -> 83.166.240.215 2022 (msg:"HOLLOWPOINT C2 viper"; tls.cert_fingerprint; content:"0884244e8fb83af16e967913de42856e3d25552a2d40402ea89a311248eb8baf"; reference:url,publicmosaic.com/indicators; sid:9102238; rev:2;)
alert tls $HOME_NET any -> 115.190.247.97 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0a298704fa65580136c0c738c681725f44c7ce4658005e94ddcf31d1912e5e60"; reference:url,publicmosaic.com/indicators; sid:9104047; rev:2;)
alert tls $HOME_NET any -> 131.143.251.246 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"132fc0f27c5462af77eada17a5a86623d750970f0f3c646e79958a2a095baa3b"; reference:url,publicmosaic.com/indicators; sid:9100606; rev:2;)
alert tls $HOME_NET any -> 132.226.72.148 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5252b8ea24a3c410e2869a79b74e689f9948643aedf2e6cd7313b0d1def1ba27"; reference:url,publicmosaic.com/indicators; sid:9100465; rev:2;)
alert tls $HOME_NET any -> 154.219.107.7 1443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"a7e1d34f51fa93ab5fad68f30b1830178b4364393cb2d04ffcf520ed83d5794b"; reference:url,publicmosaic.com/indicators; sid:9100603; rev:2;)
alert tls $HOME_NET any -> 193.233.49.79 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"31e6c4df9ac08edc4c2edb508a7ebd11aa8f26119037e90ebc5b56d2ed1086fc"; reference:url,publicmosaic.com/indicators; sid:9105937; rev:2;)
alert tls $HOME_NET any -> 195.88.191.40 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5ae71bafb5f6ab8781dd94cf48f8f4d8d5b7ea0cb9b610b1067218eb7b6e8857"; reference:url,publicmosaic.com/indicators; sid:9106643; rev:2;)