# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 20 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 2bab15409345_2bab15409345_795797892f9c — https://publicmosaic.com/ja4x/2bab15409345_2bab15409345_795797892f9c
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 1.14.234.68 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7bb7c94b881282bcd804d0d52697a177ef6b6a8cbb5261a0589f4fe01fe4daf1"; reference:url,publicmosaic.com/indicators; sid:9101260; rev:2;)
alert tls $HOME_NET any -> 43.135.34.69 43911 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"57ef4e42062b8b2f6b7e6d986a2ec73752d91c2747a4a5c4243679bd4ad1d4dd"; reference:url,publicmosaic.com/indicators; sid:9102202; rev:2;)
alert tls $HOME_NET any -> 43.143.57.45 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d7eb926e0f116a4f167b7417e61e83863e52bcb4d143f6a555df320d6e954da2"; reference:url,publicmosaic.com/indicators; sid:9102201; rev:2;)
alert tls $HOME_NET any -> 43.156.61.27 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"8b7da3f368575429d068ed8665505308239a25eac788cd0d291c2134cbffd1c3"; reference:url,publicmosaic.com/indicators; sid:9101510; rev:2;)
alert tls $HOME_NET any -> 45.150.38.95 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"50ac23ccb521d5715f3e35e673ce39f35e9a4970209b38e9cd3ecffc26c43e43"; reference:url,publicmosaic.com/indicators; sid:9102198; rev:2;)
alert tls $HOME_NET any -> 91.92.241.184 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b0a202cb6efdd0d25d7081bf6adc697d80c0d0c91f29b1db0ebd87837812bc1a"; reference:url,publicmosaic.com/indicators; sid:9105791; rev:2;)
alert tls $HOME_NET any -> 91.92.241.187 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b0a202cb6efdd0d25d7081bf6adc697d80c0d0c91f29b1db0ebd87837812bc1a"; reference:url,publicmosaic.com/indicators; sid:9105790; rev:2;)
alert tls $HOME_NET any -> 91.92.243.115 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"460bcde32bc67082373c9ad32d09e9c67337590d66b8b72301fa58fd0f6d94d1"; reference:url,publicmosaic.com/indicators; sid:9100661; rev:2;)
alert tls $HOME_NET any -> 101.36.123.12 34321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d3239b5d9d37e2833b6ea3d2f9d1f7d447d603f5e2bab8bd448a66f0e431357f"; reference:url,publicmosaic.com/indicators; sid:9102187; rev:2;)
alert tls $HOME_NET any -> 104.207.93.167 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d2bed7167d49cfd55a9ad3d9478066c7ae95a9f08426319490e1c6fc7dc95242"; reference:url,publicmosaic.com/indicators; sid:9101565; rev:2;)
alert tls $HOME_NET any -> 106.53.107.131 30943 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7bb7c94b881282bcd804d0d52697a177ef6b6a8cbb5261a0589f4fe01fe4daf1"; reference:url,publicmosaic.com/indicators; sid:9103426; rev:2;)
alert tls $HOME_NET any -> 119.45.93.117 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5e02bbdbd098874812f987e6c1b96e11f01a8d57a4a3e10a9f625fa097d11122"; reference:url,publicmosaic.com/indicators; sid:9101258; rev:2;)
alert tls $HOME_NET any -> 144.172.118.114 51956 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0a16c2485b61a2cbd3ca1d65bb881a6a5dbbc63a969736754c70c39fc9d0e925"; reference:url,publicmosaic.com/indicators; sid:9106203; rev:2;)
alert tls $HOME_NET any -> 152.42.174.192 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"eca65821089eeec29de25292bba6df135793686a9b68512ce450873eaa747e04"; reference:url,publicmosaic.com/indicators; sid:9100645; rev:2;)
alert tls $HOME_NET any -> 164.90.205.13 8080 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5b12cc346e4d17e93dee3bb02f1a0f783cc063618232070c5638b7d8f78fb01f"; reference:url,publicmosaic.com/indicators; sid:9101255; rev:2;)
alert tls $HOME_NET any -> 192.255.139.206 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"20cb37518a2fed26d1d9adf0109fb68b199436cb41347d1186ad49159c6c217b"; reference:url,publicmosaic.com/indicators; sid:9100161; rev:2;)
alert tls $HOME_NET any -> 193.32.162.108 4432 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b01bc7bc5692d0dd410de1c39589046d703bccb981a68658bbec8385001c8721"; reference:url,publicmosaic.com/indicators; sid:9103357; rev:2;)
alert tls $HOME_NET any -> 194.182.87.116 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ea52c6003627bbd718988d119d0071c6b28171206cfcd7532a1fccfa88249668"; reference:url,publicmosaic.com/indicators; sid:9100445; rev:2;)
alert tls $HOME_NET any -> 207.56.26.118 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5f6e1c65143615f14174c1e5786fafd7571f8b54fd6684d68f217d528f2f2d09"; reference:url,publicmosaic.com/indicators; sid:9103353; rev:2;)
alert tls $HOME_NET any -> 217.154.212.25 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"89cc92199152c28bbaec5937bda48a2ce14d016cfb4e7a9bbcc7c2f60fa69d34"; reference:url,publicmosaic.com/indicators; sid:9106425; rev:2;)