# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 60 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 7022c563de38_7022c563de38_0fc8c171b6ae — https://publicmosaic.com/ja4x/7022c563de38_7022c563de38_0fc8c171b6ae
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 31.57.38.195 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105543; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105542; rev:2;)
alert tls $HOME_NET any -> 31.57.38.195 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1106352fd30db92e524b69760aa62574272233e15fc144fd7b27389fdd3563cc"; reference:url,publicmosaic.com/indicators; sid:9105541; rev:2;)
alert tls $HOME_NET any -> 31.57.184.154 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"c5e50ab52aa49f2474e5df2aa15e98a3c64705c6aa89f7ae3ee67a1469873a4f"; reference:url,publicmosaic.com/indicators; sid:9101285; rev:2;)
alert tls $HOME_NET any -> 31.57.219.139 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"8f9157c3c543ea5a0dcec829f606c5fc957c0055cabef20eacc5824ea69aea6b"; reference:url,publicmosaic.com/indicators; sid:9101284; rev:2;)
alert tls $HOME_NET any -> 45.11.230.111 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e6e9e62afecbf07a1160ba4d0bf7bee7aebb8e5465ded5c4af683fc81146a3b2"; reference:url,publicmosaic.com/indicators; sid:9105131; rev:2;)
alert tls $HOME_NET any -> 45.11.230.111 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e6e9e62afecbf07a1160ba4d0bf7bee7aebb8e5465ded5c4af683fc81146a3b2"; reference:url,publicmosaic.com/indicators; sid:9105129; rev:2;)
alert tls $HOME_NET any -> 45.192.211.116 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"1adca882e4c5aad436a77549adf345a0750496407b605ec42e3f38bef6440217"; reference:url,publicmosaic.com/indicators; sid:9106071; rev:2;)
alert tls $HOME_NET any -> 66.179.29.5 2000 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7ee97a771e202ee1db01a20e35437228a44486e1e9166b41c2cccbf388fd5588"; reference:url,publicmosaic.com/indicators; sid:9103943; rev:2;)
alert tls $HOME_NET any -> 66.179.29.5 5000 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"7ee97a771e202ee1db01a20e35437228a44486e1e9166b41c2cccbf388fd5588"; reference:url,publicmosaic.com/indicators; sid:9103942; rev:2;)
alert tls $HOME_NET any -> 77.83.39.141 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"6402d7b969b86630b4342abcba4010606690ccb1bf1a2ec167079cdf82caf59a"; reference:url,publicmosaic.com/indicators; sid:9104050; rev:2;)
alert tls $HOME_NET any -> 94.228.166.168 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"04f1d68c498c75ff5f897624d435129470e9c9c0a2260575a0df3914a5046e05"; reference:url,publicmosaic.com/indicators; sid:9101435; rev:2;)
alert tls $HOME_NET any -> 94.228.166.168 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"04f1d68c498c75ff5f897624d435129470e9c9c0a2260575a0df3914a5046e05"; reference:url,publicmosaic.com/indicators; sid:9101434; rev:2;)
alert tls $HOME_NET any -> 104.143.46.142 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fac3af053b268e18b02096cda89efc028024c08caac73e86f337397b4857cef0"; reference:url,publicmosaic.com/indicators; sid:9104044; rev:2;)
alert tls $HOME_NET any -> 104.143.46.142 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"fac3af053b268e18b02096cda89efc028024c08caac73e86f337397b4857cef0"; reference:url,publicmosaic.com/indicators; sid:9104043; rev:2;)
alert tls $HOME_NET any -> 125.62.77.141 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"82aeafab427674c4ab36f5483a6ee136e1bc25c326ce1c04d5abd74722332493"; reference:url,publicmosaic.com/indicators; sid:9101294; rev:2;)
alert tls $HOME_NET any -> 136.0.213.135 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a78a912fed18e128762841b1f782745877d6db1674a5e5fc507d882ddad10512"; reference:url,publicmosaic.com/indicators; sid:9101569; rev:2;)
alert tls $HOME_NET any -> 136.0.213.135 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a78a912fed18e128762841b1f782745877d6db1674a5e5fc507d882ddad10512"; reference:url,publicmosaic.com/indicators; sid:9101568; rev:2;)
alert tls $HOME_NET any -> 136.0.213.135 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"a78a912fed18e128762841b1f782745877d6db1674a5e5fc507d882ddad10512"; reference:url,publicmosaic.com/indicators; sid:9101181; rev:2;)
alert tls $HOME_NET any -> 148.66.5.59 4443 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3cc75ff995302462eb0fa4f074743f142c1b0d2d3ceb81b8292cc792cbba679f"; reference:url,publicmosaic.com/indicators; sid:9105779; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101233; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101229; rev:2;)
alert tls $HOME_NET any -> 154.201.82.105 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101224; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101222; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101231; rev:2;)
alert tls $HOME_NET any -> 154.201.82.106 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101227; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101223; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101226; rev:2;)
alert tls $HOME_NET any -> 154.201.82.108 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"057db3c6b9101e769a978658f4dd248bca7dc9e6d5c7f055264219e0286e939a"; reference:url,publicmosaic.com/indicators; sid:9101225; rev:2;)
alert tls $HOME_NET any -> 168.222.97.92 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"31181115b28e0ecf1ca51a78830214e764458c95c9f0bf6f21141b9f45e5d474"; reference:url,publicmosaic.com/indicators; sid:9101332; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 3001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101232; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 56011 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101228; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 56012 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101230; rev:2;)
alert tls $HOME_NET any -> 172.111.198.212 56013 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b7e956c62ed014f878581f1213700129c999c9052ff146cc09c99dc3650fc3c2"; reference:url,publicmosaic.com/indicators; sid:9101638; rev:2;)
alert tls $HOME_NET any -> 183.90.187.2 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101170; rev:2;)
alert tls $HOME_NET any -> 183.90.187.73 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101171; rev:2;)
alert tls $HOME_NET any -> 183.90.187.111 10888 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"f835a95a8e5f08fe951a0cf4b373e568bb2a63db5c11d350264d66c545efc81f"; reference:url,publicmosaic.com/indicators; sid:9101172; rev:2;)
alert tls $HOME_NET any -> 185.198.58.107 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"31905a421acc8f2d3b45e6ba7066163aecc0f5c9d325357d37323fa5146e2b0a"; reference:url,publicmosaic.com/indicators; sid:9101169; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101167; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101159; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101162; rev:2;)
alert tls $HOME_NET any -> 192.229.115.243 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101165; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101158; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101166; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101154; rev:2;)
alert tls $HOME_NET any -> 192.229.115.246 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101160; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101156; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101164; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101163; rev:2;)
alert tls $HOME_NET any -> 192.229.115.254 56004 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"3dd240b2c990b0c42d2a7a84fc22437896a70835173bca14fb5cea3fb1558d42"; reference:url,publicmosaic.com/indicators; sid:9101161; rev:2;)
alert tls $HOME_NET any -> 193.233.126.164 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"456e9e0986cd639929e180e1faf09a32db6a81e63872381a1421badeee9851bd"; reference:url,publicmosaic.com/indicators; sid:9101157; rev:2;)
alert tls $HOME_NET any -> 193.233.126.164 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"456e9e0986cd639929e180e1faf09a32db6a81e63872381a1421badeee9851bd"; reference:url,publicmosaic.com/indicators; sid:9101155; rev:2;)
alert tls $HOME_NET any -> 193.233.126.164 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"456e9e0986cd639929e180e1faf09a32db6a81e63872381a1421badeee9851bd"; reference:url,publicmosaic.com/indicators; sid:9101153; rev:2;)
alert tls $HOME_NET any -> 195.177.94.188 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5ebb95227dba294fb7be6175c1a6d2e872245fc68781ebad252273c3287d4f6"; reference:url,publicmosaic.com/indicators; sid:9101756; rev:2;)
alert tls $HOME_NET any -> 195.177.94.188 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5ebb95227dba294fb7be6175c1a6d2e872245fc68781ebad252273c3287d4f6"; reference:url,publicmosaic.com/indicators; sid:9101755; rev:2;)
alert tls $HOME_NET any -> 195.177.94.188 56003 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"b5ebb95227dba294fb7be6175c1a6d2e872245fc68781ebad252273c3287d4f6"; reference:url,publicmosaic.com/indicators; sid:9101754; rev:2;)
alert tls $HOME_NET any -> 196.251.121.124 2008 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ccbbd0434e23ffd0e69dc9422c08fb63a00c6c38b78bb65fbd79a63b06cf1d85"; reference:url,publicmosaic.com/indicators; sid:9101753; rev:2;)
alert tls $HOME_NET any -> 196.251.121.124 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"ccbbd0434e23ffd0e69dc9422c08fb63a00c6c38b78bb65fbd79a63b06cf1d85"; reference:url,publicmosaic.com/indicators; sid:9101280; rev:2;)
alert tls $HOME_NET any -> 217.60.102.3 56001 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e919324123345f95ef70e39edc18cd08fdf9a6c40c1bb6a7bdc44dd702a32ddf"; reference:url,publicmosaic.com/indicators; sid:9101323; rev:2;)
alert tls $HOME_NET any -> 217.60.102.3 56002 (msg:"HOLLOWPOINT C2 pure_rat"; tls.cert_fingerprint; content:"e919324123345f95ef70e39edc18cd08fdf9a6c40c1bb6a7bdc44dd702a32ddf"; reference:url,publicmosaic.com/indicators; sid:9101322; rev:2;)