# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 6 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 7022c563de38_7022c563de38_11ae22c38173 — https://publicmosaic.com/ja4x/7022c563de38_7022c563de38_11ae22c38173
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 82.29.71.130 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"2b0e0fceac6e9262a199eb93c31e41277133f8fad1ed881a7c236b57cf297c56"; reference:url,publicmosaic.com/indicators; sid:9105798; rev:2;)
alert tls $HOME_NET any -> 89.44.9.164 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"28a3f82abe970277f07e3df989e274d900a7c4867ecedd27d0617f7f00c009f6"; reference:url,publicmosaic.com/indicators; sid:9101304; rev:2;)
alert tls $HOME_NET any -> 139.84.152.226 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"02cba045703501c064ee46b40a1635a5596fb8600f64827c527d95542a398992"; reference:url,publicmosaic.com/indicators; sid:9100801; rev:2;)
alert tls $HOME_NET any -> 146.70.87.173 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c2c15101b0048c195cc78d29e4c698c74c05ec55e63ab733446e51d478798cb4"; reference:url,publicmosaic.com/indicators; sid:9106645; rev:2;)
alert tls $HOME_NET any -> 205.234.170.231 8444 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"aee37e9ae8c801381cce56ac548acd45e8b6e1559aa46df4973617dca2a71b19"; reference:url,publicmosaic.com/indicators; sid:9100627; rev:2;)
alert tls $HOME_NET any -> 207.148.122.131 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0b6a6c3661565591defc516f7292b264b965e1bac86cc78b8f94dbb2c51bca0d"; reference:url,publicmosaic.com/indicators; sid:9100626; rev:2;)