# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 33 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 4f24da86fad6_4f24da86fad6_e440e854f133 — https://publicmosaic.com/ja4x/4f24da86fad6_4f24da86fad6_e440e854f133
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 2.88.92.98 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"19890bf6add5d54a582a980457347e7b82c86ac08dd1b63cc1b52b2370a6405c"; reference:url,publicmosaic.com/indicators; sid:9100429; rev:2;)
alert tls $HOME_NET any -> 2.91.182.143 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"53e252a76dbd386ab936f4101ed3bf3c4dbde784d09e8d4e35dd9732be7ca0ea"; reference:url,publicmosaic.com/indicators; sid:9104045; rev:2;)
alert tls $HOME_NET any -> 2.91.185.72 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"145095cbd4d76af347795c463f105b319595cbfb757d2b48b41357498cea6170"; reference:url,publicmosaic.com/indicators; sid:9101326; rev:2;)
alert tls $HOME_NET any -> 3.39.249.68 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"ecccb50c92d8465b5c037c0f2505ee8767326e544d90021723d34d1a653c4831"; reference:url,publicmosaic.com/indicators; sid:9103975; rev:2;)
alert tls $HOME_NET any -> 4.193.136.143 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"98dfe4210517e50c68c6e82157f7d99cc41d012b29bff1d46fc53eb8dcb16927"; reference:url,publicmosaic.com/indicators; sid:9100569; rev:2;)
alert tls $HOME_NET any -> 16.5.7.159 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b7c7fd53a74c65d78e6a8f1d2961e84ae868edd7be4c5fc04c9a08c0ffee7671"; reference:url,publicmosaic.com/indicators; sid:9106735; rev:2;)
alert tls $HOME_NET any -> 20.2.140.201 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"e52ce0cb37e4e5eb28ffb7be345fb72158701d801f0907f1104659eacf73b75d"; reference:url,publicmosaic.com/indicators; sid:9103896; rev:2;)
alert tls $HOME_NET any -> 20.2.140.201 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"96ec4421ae52bc0763d58b769aee1941870407f0e62fc57254dcf5cf181e3c1c"; reference:url,publicmosaic.com/indicators; sid:9104180; rev:2;)
alert tls $HOME_NET any -> 20.39.60.137 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"0cfcc6df36b4da5e87c2ae5a78a367c2defc46283d4bf49dab9fa1e26a8c108c"; reference:url,publicmosaic.com/indicators; sid:9100562; rev:2;)
alert tls $HOME_NET any -> 43.134.42.247 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"11290ba2ec7a171b4afecda0d1095855df241063af5d51e246df177911f37e21"; reference:url,publicmosaic.com/indicators; sid:9100581; rev:2;)
alert tls $HOME_NET any -> 46.63.0.187 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"f751b21df7806aa20a78239ecd735b75a88b8b415129baa9b9a817134e398517"; reference:url,publicmosaic.com/indicators; sid:9100770; rev:2;)
alert tls $HOME_NET any -> 49.232.135.25 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6c90ed256aa5b8249f59cfcfe3bff5902780afa2f02f713dcdc3221ab25f2dca"; reference:url,publicmosaic.com/indicators; sid:9100768; rev:2;)
alert tls $HOME_NET any -> 50.60.157.152 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"badde35bcc382152dbe73a1ad6fbec99d0206712971ad201c6a350f132d64301"; reference:url,publicmosaic.com/indicators; sid:9105657; rev:2;)
alert tls $HOME_NET any -> 66.78.40.93 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"37dc207b42768ce5b842d2dadab6a356c6c331ef37bb3d04071c3db2b23dab54"; reference:url,publicmosaic.com/indicators; sid:9105817; rev:2;)
alert tls $HOME_NET any -> 68.178.205.17 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cdb306499f0da4400436c6c2e89aa80ee0cddbab9739931bef3c95d1e0f4b9c5"; reference:url,publicmosaic.com/indicators; sid:9100736; rev:2;)
alert tls $HOME_NET any -> 82.156.224.184 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"77e6db88c612b5dce6a78c88cf97079746a60158c704a1c799849d7a782eb357"; reference:url,publicmosaic.com/indicators; sid:9103954; rev:2;)
alert tls $HOME_NET any -> 89.125.48.185 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6502a2b0ebf21e29b19ddc3660c0144f7e1f6a6d3c9e152b958047dff1dfc64c"; reference:url,publicmosaic.com/indicators; sid:9104164; rev:2;)
alert tls $HOME_NET any -> 93.152.223.39 28447 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"240cdb3066a31fabf92a2e2dba34e6e526f1bee92023e86e73ffc7cfcec9848e"; reference:url,publicmosaic.com/indicators; sid:9100034; rev:2;)
alert tls $HOME_NET any -> 104.248.156.16 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"5ed089289ea8b3ced194bbfbf59795a1c2ba512cab77d93f16d690b16a589a02"; reference:url,publicmosaic.com/indicators; sid:9106390; rev:2;)
alert tls $HOME_NET any -> 107.172.22.3 8888 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"17cf0c9c1af832741de83acb9817e35438c2afa5be09a494c415ae222f3cd6b2"; reference:url,publicmosaic.com/indicators; sid:9103953; rev:2;)
alert tls $HOME_NET any -> 124.220.55.95 23333 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a19ea9e0f98ad7222d21cab2ab539730ed7e2c9f4005f43bc5ea3f7ea1604996"; reference:url,publicmosaic.com/indicators; sid:9103779; rev:2;)
alert tls $HOME_NET any -> 143.198.120.167 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"bd30c1c4afd5950d0eb41777c07a167f7edfeccf037eae20b19d6d5435522584"; reference:url,publicmosaic.com/indicators; sid:9105681; rev:2;)
alert tls $HOME_NET any -> 146.190.80.105 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"28af1dad02e5edf428670e964dccbe0882e181480321f0f3c311dcdde4e94ca4"; reference:url,publicmosaic.com/indicators; sid:9100567; rev:2;)
alert tls $HOME_NET any -> 154.46.30.12 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"8a10c904aa70a37961bd0bee0347046ffedeb73546e288db3a5cf94519feb2c3"; reference:url,publicmosaic.com/indicators; sid:9106558; rev:2;)
alert tls $HOME_NET any -> 159.89.192.91 8080 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"612c0dd896261c396ce44d31dec8f53178ff3cbb119591b11dcdfd3eac9e6605"; reference:url,publicmosaic.com/indicators; sid:9104225; rev:2;)
alert tls $HOME_NET any -> 161.35.176.231 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b1932d33e37714b4c4324e14dfda74c748dfd8d2ff7fe0fbf66dfa3f0f970d10"; reference:url,publicmosaic.com/indicators; sid:9100570; rev:2;)
alert tls $HOME_NET any -> 161.35.239.147 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"863fed66ddcf7293d547ee6017c85c54e531c0dd3ac5a59ce96e9f4f5be3b266"; reference:url,publicmosaic.com/indicators; sid:9105679; rev:2;)
alert tls $HOME_NET any -> 162.243.160.70 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cd78457626be98c8a75fe00a9d5aeabacc432cebbb5b52938cdfabf9aca6514f"; reference:url,publicmosaic.com/indicators; sid:9101333; rev:2;)
alert tls $HOME_NET any -> 172.239.45.42 81 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"6b64a81be95746ba51510915028942acc29971d14f53604e05c9a05f079568dd"; reference:url,publicmosaic.com/indicators; sid:9100691; rev:2;)
alert tls $HOME_NET any -> 191.252.184.198 1080 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"28edfc9ff0f962b50d47df3c9952157d2d3e6d11c725226496b1bca14be28dcf"; reference:url,publicmosaic.com/indicators; sid:9104994; rev:2;)
alert tls $HOME_NET any -> 191.252.184.198 1337 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"ef18d58b2c46dc0b0c80a28d7e8b5a8600855a9130cb35a5a300eb6b156f0797"; reference:url,publicmosaic.com/indicators; sid:9100080; rev:2;)
alert tls $HOME_NET any -> 192.169.176.54 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cdb306499f0da4400436c6c2e89aa80ee0cddbab9739931bef3c95d1e0f4b9c5"; reference:url,publicmosaic.com/indicators; sid:9100745; rev:2;)
alert tls $HOME_NET any -> 206.81.21.156 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"3d56aadb7101660dd84db7627acc4e908046f6f9514ea0a630deedb1cc0545db"; reference:url,publicmosaic.com/indicators; sid:9100743; rev:2;)