# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 38 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 7022c563de38_7022c563de38_000000000000 — https://publicmosaic.com/ja4x/7022c563de38_7022c563de38_000000000000
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 5.230.201.54 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"62bdbfea69893ad1722429c83bafdb2fed99474c150f8ecbf08cf529cdda59e5"; reference:url,publicmosaic.com/indicators; sid:9101291; rev:2;)
alert tls $HOME_NET any -> 5.230.201.54 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"62bdbfea69893ad1722429c83bafdb2fed99474c150f8ecbf08cf529cdda59e5"; reference:url,publicmosaic.com/indicators; sid:9101587; rev:2;)
alert tls $HOME_NET any -> 5.230.201.54 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"62bdbfea69893ad1722429c83bafdb2fed99474c150f8ecbf08cf529cdda59e5"; reference:url,publicmosaic.com/indicators; sid:9101586; rev:2;)
alert tls $HOME_NET any -> 20.63.75.128 1488 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"23a2e6c8bba29d9573f0b4698da369350fcad9f8638feff2bd69f79638f88a6f"; reference:url,publicmosaic.com/indicators; sid:9105104; rev:2;)
alert tls $HOME_NET any -> 23.153.36.72 3132 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"3a7cad7b96e1d8eda214bfd7b8bc29f847a488ab16e2e53a4d65d6dc57bae68e"; reference:url,publicmosaic.com/indicators; sid:9101706; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1db528fbc7492b5de00cd2c8d1f22335bd924bcf7617d228e419fd529becfd07"; reference:url,publicmosaic.com/indicators; sid:9101247; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1db528fbc7492b5de00cd2c8d1f22335bd924bcf7617d228e419fd529becfd07"; reference:url,publicmosaic.com/indicators; sid:9101245; rev:2;)
alert tls $HOME_NET any -> 23.226.68.34 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1db528fbc7492b5de00cd2c8d1f22335bd924bcf7617d228e419fd529becfd07"; reference:url,publicmosaic.com/indicators; sid:9101244; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9106075; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9106074; rev:2;)
alert tls $HOME_NET any -> 37.120.222.88 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"684d959df00af1b4b0242f5846b3d1b54df3b0b61bffbbde7438e7be996c6810"; reference:url,publicmosaic.com/indicators; sid:9104688; rev:2;)
alert tls $HOME_NET any -> 37.183.240.33 443 (msg:"HOLLOWPOINT C2 unam"; tls.cert_fingerprint; content:"016973380c0f1df00bd9593ed8d5efa3706cd6df7993f6141272b80522acdd23"; reference:url,publicmosaic.com/indicators; sid:9103345; rev:2;)
alert tls $HOME_NET any -> 38.240.48.155 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7f1cc9f4b534eda288c7a1de2a45ba41497ad6d47443e6f552f0603816f304f"; reference:url,publicmosaic.com/indicators; sid:9101283; rev:2;)
alert tls $HOME_NET any -> 45.139.104.226 49001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"4c12dd5cd3dbf519f29501e4cf4909ba20b8af456b37e0f9c6c7f08d68211de4"; reference:url,publicmosaic.com/indicators; sid:9105128; rev:2;)
alert tls $HOME_NET any -> 65.1.70.222 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b45ea1d96442c5956fe49f01d830e8787004ada764870a2a79c959247223f62a"; reference:url,publicmosaic.com/indicators; sid:9101289; rev:2;)
alert tls $HOME_NET any -> 80.76.49.78 8080 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"feff7a5bfeb6036d428602cb82555dfe6acbc28d35d20429f846020d6c5ac32e"; reference:url,publicmosaic.com/indicators; sid:9100898; rev:2;)
alert tls $HOME_NET any -> 84.201.20.74 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ecb28dd1de46b0e824cd4144ee1e8e5c0f247ca8184f67b058f8e56e68b43010"; reference:url,publicmosaic.com/indicators; sid:9101466; rev:2;)
alert tls $HOME_NET any -> 84.201.20.74 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ecb28dd1de46b0e824cd4144ee1e8e5c0f247ca8184f67b058f8e56e68b43010"; reference:url,publicmosaic.com/indicators; sid:9101465; rev:2;)
alert tls $HOME_NET any -> 91.92.40.138 4838 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"490fa39ca4a5971533e19fcc396868c905c70cca3555b9a97479872101c5f712"; reference:url,publicmosaic.com/indicators; sid:9101705; rev:2;)
alert tls $HOME_NET any -> 91.92.243.36 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"4a172c28e3ea3f86d93aec642d017b528414ca3f6ca2959ed03238b1a43c5d97"; reference:url,publicmosaic.com/indicators; sid:9101436; rev:2;)
alert tls $HOME_NET any -> 95.133.229.173 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c0a3a13b2a0aa3013fa37c2dc34c2fce4f631e6730a394b7c01d081dd24fd616"; reference:url,publicmosaic.com/indicators; sid:9101464; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101667; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101666; rev:2;)
alert tls $HOME_NET any -> 103.54.153.49 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c53128ba36cb23239c9c4e1c75c4af61aaddd22180ab1c20ee5bb1419caeed9a"; reference:url,publicmosaic.com/indicators; sid:9101665; rev:2;)
alert tls $HOME_NET any -> 104.254.90.162 28471 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7f176319f7a4637f8d22e3478559eb4e81f28a1c3e5245d95bfa58314d23f2c7"; reference:url,publicmosaic.com/indicators; sid:9101658; rev:2;)
alert tls $HOME_NET any -> 148.224.63.66 7070 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"eb2687638a42b4d0c2ba0e153fa99928e87b7ff24e93621a9f74fad410df0016"; reference:url,publicmosaic.com/indicators; sid:9100900; rev:2;)
alert tls $HOME_NET any -> 151.241.154.217 6767 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"78944886388d534c02de69cfe214ab325414e9c7b71527723e4652b8631f13ba"; reference:url,publicmosaic.com/indicators; sid:9100897; rev:2;)
alert tls $HOME_NET any -> 151.242.63.30 8080 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"6b88cfcd6a64409db6389bea2f84a249d9e2d23d634f1d36ddec36472a01ba85"; reference:url,publicmosaic.com/indicators; sid:9101282; rev:2;)
alert tls $HOME_NET any -> 158.174.50.97 7000 (msg:"HOLLOWPOINT C2 raton_rat"; tls.cert_fingerprint; content:"d10428f5617c13be575a11f6da68f0aeddc25e6ee462fc36eafe36e470f1f382"; reference:url,publicmosaic.com/indicators; sid:9101519; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101235; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101236; rev:2;)
alert tls $HOME_NET any -> 172.237.88.168 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a11bfe2cbaf8760a2b2c03b50e858973cf1879eeb6ba38a33a425ee13602ef1c"; reference:url,publicmosaic.com/indicators; sid:9101234; rev:2;)
alert tls $HOME_NET any -> 178.16.55.133 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a68234874e32dda82ae90383b731cb4c0e6d53737059876b1f979cea13d02a73"; reference:url,publicmosaic.com/indicators; sid:9101286; rev:2;)
alert tls $HOME_NET any -> 203.159.90.177 55006 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c43566595e58b5ca38a4f089e1f7958ec57f78d5637496e5d288dc2c97d40f64"; reference:url,publicmosaic.com/indicators; sid:9101517; rev:2;)
alert tls $HOME_NET any -> 209.99.186.142 55009 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ef3dd28f183d18a8675402c8d3d238a066af26797351db0f6799a0ff50bbf8d9"; reference:url,publicmosaic.com/indicators; sid:9101324; rev:2;)
alert tls $HOME_NET any -> 217.60.195.89 443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7f176319f7a4637f8d22e3478559eb4e81f28a1c3e5245d95bfa58314d23f2c7"; reference:url,publicmosaic.com/indicators; sid:9101150; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"418879f0d93b428e684727c9b52207da40485f391d7116df482c67949ced2903"; reference:url,publicmosaic.com/indicators; sid:9101469; rev:2;)
alert tls $HOME_NET any -> 217.60.195.109 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"418879f0d93b428e684727c9b52207da40485f391d7116df482c67949ced2903"; reference:url,publicmosaic.com/indicators; sid:9101468; rev:2;)