# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 26 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 7022c563de38_7022c563de38_795797892f9c — https://publicmosaic.com/ja4x/7022c563de38_7022c563de38_795797892f9c
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 2.56.222.17 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"bf8f8491ba96ef9f594b6a74623bf1d33519a12841c30e87c699d3dca90fd8c0"; reference:url,publicmosaic.com/indicators; sid:9105792; rev:2;)
alert tls $HOME_NET any -> 8.146.235.16 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4acfcac0fd14e7d5750ee15e9befbd4966f9fa4f078ec004a18502a33dfdad5e"; reference:url,publicmosaic.com/indicators; sid:9105121; rev:2;)
alert tls $HOME_NET any -> 13.236.153.60 8888 (msg:"HOLLOWPOINT C2 asyncrat"; tls.cert_fingerprint; content:"472dcc1ee4acfca148d051ebec7c9582ff4b27413d590c59805a7fac5f93d0b7"; reference:url,publicmosaic.com/indicators; sid:9103656; rev:2;)
alert tls $HOME_NET any -> 38.54.97.169 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"567080c8ede967bcb042a54d65179cd376fb651b2d98c95079d892fa53434ffb"; reference:url,publicmosaic.com/indicators; sid:9106565; rev:2;)
alert tls $HOME_NET any -> 45.139.226.224 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"72d36f1c13c5f44988b6b6092b36004f6d45f2baa231f97a8494a974feb09f51"; reference:url,publicmosaic.com/indicators; sid:9102199; rev:2;)
alert tls $HOME_NET any -> 69.48.229.91 9443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4eec5aee3924ac4c34310c943a50adb52f157601872d8974c40c59d9a254b1a0"; reference:url,publicmosaic.com/indicators; sid:9106356; rev:2;)
alert tls $HOME_NET any -> 85.155.186.2 3821 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5d07b7222ff73ed7bce7b6707b4d2c3d2c6a8e82382323abafa9e1c519948777"; reference:url,publicmosaic.com/indicators; sid:9102192; rev:2;)
alert tls $HOME_NET any -> 107.173.160.185 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ba5406db3a6f183c2e9397c337094f1fd4e890f3161b2db36cf8abcad9d411b9"; reference:url,publicmosaic.com/indicators; sid:9100466; rev:2;)
alert tls $HOME_NET any -> 119.28.212.86 44321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b9438277f002116ec8278c0d5f5bd2f8fec5fe3833a8f768dfe1e0dba996c05d"; reference:url,publicmosaic.com/indicators; sid:9102183; rev:2;)
alert tls $HOME_NET any -> 119.45.105.71 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b083bad4967a9af4814c0b0f14c539a04b4978b85b1b8ecdd02ed8f4cc634d9c"; reference:url,publicmosaic.com/indicators; sid:9105292; rev:2;)
alert tls $HOME_NET any -> 119.91.246.156 8989 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3888138f6de064adf3f617d7a5edd7bc9646fd2c866af1b4d6e96b178a9f33d6"; reference:url,publicmosaic.com/indicators; sid:9103369; rev:2;)
alert tls $HOME_NET any -> 137.175.107.110 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ae5b97bc603751eb4beb6b6d7c27f859c5d814735916c0bea2df4fe4e450db72"; reference:url,publicmosaic.com/indicators; sid:9104244; rev:2;)
alert tls $HOME_NET any -> 139.199.160.80 32408 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3888138f6de064adf3f617d7a5edd7bc9646fd2c866af1b4d6e96b178a9f33d6"; reference:url,publicmosaic.com/indicators; sid:9103366; rev:2;)
alert tls $HOME_NET any -> 144.124.234.128 49999 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"1306871b1dba51e873498ee8b8d03444cf9fd9ae76114bbd782e4bbdbcb979fb"; reference:url,publicmosaic.com/indicators; sid:9103365; rev:2;)
alert tls $HOME_NET any -> 155.138.215.87 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"58e2bbeb8ee14fba1ac67cdcd1bf881ca8781e382f625dcdf2a4198ba9259df3"; reference:url,publicmosaic.com/indicators; sid:9103361; rev:2;)
alert tls $HOME_NET any -> 158.158.17.236 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ecd899384970aeead477859267c00bdb56d67544ea9412127b0204520b983043"; reference:url,publicmosaic.com/indicators; sid:9106736; rev:2;)
alert tls $HOME_NET any -> 164.68.123.50 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"bfb8f9a46992f6828544a1d1ac5ac3ecdf0eb403623fbad7e338b569386ee22b"; reference:url,publicmosaic.com/indicators; sid:9100457; rev:2;)
alert tls $HOME_NET any -> 185.147.83.59 48321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"662bfe92990276874b38a55961777b78e6bad7f31ebd87825b64e66f35cd3e4b"; reference:url,publicmosaic.com/indicators; sid:9103359; rev:2;)
alert tls $HOME_NET any -> 185.227.152.231 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b902ebe6b057b2b251c7a5d04809ae88b0660db72dbf3c5830c4ad5a99740c6d"; reference:url,publicmosaic.com/indicators; sid:9104104; rev:2;)
alert tls $HOME_NET any -> 193.111.117.26 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6248ec2daa7c752e429ca0945000e3e577fa8b8db8a3d3555b43ec6933e07889"; reference:url,publicmosaic.com/indicators; sid:9105938; rev:2;)
alert tls $HOME_NET any -> 193.112.169.214 30727 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"380197285f0e1f1df6336a0e4eaa7648c9f7d4b467b0d36c0cd3def0ba5030a9"; reference:url,publicmosaic.com/indicators; sid:9103356; rev:2;)
alert tls $HOME_NET any -> 193.112.254.32 8989 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"380197285f0e1f1df6336a0e4eaa7648c9f7d4b467b0d36c0cd3def0ba5030a9"; reference:url,publicmosaic.com/indicators; sid:9103355; rev:2;)
alert tls $HOME_NET any -> 193.181.213.156 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"4d882e088bf4b0a6da90fa66492dc2adb51ab548700aec06546cdda8f881f61e"; reference:url,publicmosaic.com/indicators; sid:9101024; rev:2;)
alert tls $HOME_NET any -> 193.233.220.65 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"cb1d3d9374c01590f54ba5cbdac72a2d4b0741c1f62b45de90080f452bfab336"; reference:url,publicmosaic.com/indicators; sid:9100079; rev:2;)
alert tls $HOME_NET any -> 198.13.47.210 4432 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"15be9e6179d84dd48a419945a51c178aa88a3fdc609661f2de2634908372e23b"; reference:url,publicmosaic.com/indicators; sid:9105337; rev:2;)
alert tls $HOME_NET any -> 212.47.241.124 55555 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6407f02fa6f21ed8651c1cb5c470ac02d19f5b16a573f3bbcc89652c04fdf7c1"; reference:url,publicmosaic.com/indicators; sid:9100440; rev:2;)