# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 39 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 769119f9990f_769119f9990f_e1926048963f — https://publicmosaic.com/ja4x/769119f9990f_769119f9990f_e1926048963f
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 31.77.248.3 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"e47227671798eaa53a4c2b632ffbf114b29d389d1279472a665fa702061ad9a4"; reference:url,publicmosaic.com/indicators; sid:9101290; rev:2;)
alert tls $HOME_NET any -> 45.141.215.40 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"f688800cd1501f8e13b64d6231db9e91b8dad410cce7e838ba3e2a269000af02"; reference:url,publicmosaic.com/indicators; sid:9101292; rev:2;)
alert tls $HOME_NET any -> 46.151.182.30 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"3047699a8c734230d8efb9f5a216f1f63cf628464cb7dca9312982f71608acad"; reference:url,publicmosaic.com/indicators; sid:9103298; rev:2;)
alert tls $HOME_NET any -> 46.151.182.30 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"3047699a8c734230d8efb9f5a216f1f63cf628464cb7dca9312982f71608acad"; reference:url,publicmosaic.com/indicators; sid:9103297; rev:2;)
alert tls $HOME_NET any -> 46.151.182.98 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"1ffe4fb2900415c8265d1d302f89bae3ba7c2436a8c3100988c04cabe548b118"; reference:url,publicmosaic.com/indicators; sid:9101051; rev:2;)
alert tls $HOME_NET any -> 46.151.182.98 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"1ffe4fb2900415c8265d1d302f89bae3ba7c2436a8c3100988c04cabe548b118"; reference:url,publicmosaic.com/indicators; sid:9101059; rev:2;)
alert tls $HOME_NET any -> 64.89.160.77 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"635024d5b905caf41c7b01411313bb7299d33b79d8f5e09077a12793f7a6b89a"; reference:url,publicmosaic.com/indicators; sid:9101054; rev:2;)
alert tls $HOME_NET any -> 64.89.160.140 7040 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"6fc341a3014bb1653d344f6fa741af308d4aeaad1ef55cbf585239ed1a57ef37"; reference:url,publicmosaic.com/indicators; sid:9101055; rev:2;)
alert tls $HOME_NET any -> 64.89.160.140 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"6fc341a3014bb1653d344f6fa741af308d4aeaad1ef55cbf585239ed1a57ef37"; reference:url,publicmosaic.com/indicators; sid:9101056; rev:2;)
alert tls $HOME_NET any -> 80.76.49.47 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"b208d25572861170e0bf53a630eec6152752077a44e7b3f9dcba1d053407db70"; reference:url,publicmosaic.com/indicators; sid:9101058; rev:2;)
alert tls $HOME_NET any -> 80.76.49.47 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"b208d25572861170e0bf53a630eec6152752077a44e7b3f9dcba1d053407db70"; reference:url,publicmosaic.com/indicators; sid:9101057; rev:2;)
alert tls $HOME_NET any -> 82.29.101.38 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"f688800cd1501f8e13b64d6231db9e91b8dad410cce7e838ba3e2a269000af02"; reference:url,publicmosaic.com/indicators; sid:9101293; rev:2;)
alert tls $HOME_NET any -> 84.38.129.111 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"45b8d53cc40b19b2b2a0952c427254202f450866b3c1e29f0ffc86ea34042621"; reference:url,publicmosaic.com/indicators; sid:9104454; rev:2;)
alert tls $HOME_NET any -> 84.38.129.111 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"45b8d53cc40b19b2b2a0952c427254202f450866b3c1e29f0ffc86ea34042621"; reference:url,publicmosaic.com/indicators; sid:9101251; rev:2;)
alert tls $HOME_NET any -> 91.124.98.25 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"3f2f69f5e860e8b807b4016d116a3fc965501dcb96a33429c076315e8aed154a"; reference:url,publicmosaic.com/indicators; sid:9101047; rev:2;)
alert tls $HOME_NET any -> 91.124.98.25 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"3f2f69f5e860e8b807b4016d116a3fc965501dcb96a33429c076315e8aed154a"; reference:url,publicmosaic.com/indicators; sid:9101046; rev:2;)
alert tls $HOME_NET any -> 93.152.221.227 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"c368d109d03c343d31c71bc3cbb021b302293ec65b28c2eda2f3496087c300f7"; reference:url,publicmosaic.com/indicators; sid:9101514; rev:2;)
alert tls $HOME_NET any -> 93.152.221.227 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"c368d109d03c343d31c71bc3cbb021b302293ec65b28c2eda2f3496087c300f7"; reference:url,publicmosaic.com/indicators; sid:9101513; rev:2;)
alert tls $HOME_NET any -> 101.201.109.2 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"ff08aca05fc74ddae8b7b8cd90681408805e81787950b8728d29ec7434ad65ea"; reference:url,publicmosaic.com/indicators; sid:9104176; rev:2;)
alert tls $HOME_NET any -> 144.217.94.115 443 (msg:"HOLLOWPOINT C2 evilginx"; tls.cert_fingerprint; content:"610f4b94689b74546333752e870a3a0e4557bbc3aeb865408b8773c80c148506"; reference:url,publicmosaic.com/indicators; sid:9103867; rev:2;)
alert tls $HOME_NET any -> 155.117.183.31 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"d13ffc1a747447b127e439d39609931d1d755eb6223fbe2552bbc5768f095cb1"; reference:url,publicmosaic.com/indicators; sid:9101038; rev:2;)
alert tls $HOME_NET any -> 155.117.183.31 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"d13ffc1a747447b127e439d39609931d1d755eb6223fbe2552bbc5768f095cb1"; reference:url,publicmosaic.com/indicators; sid:9101037; rev:2;)
alert tls $HOME_NET any -> 172.245.155.83 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"23e64b1e39618b19315eb62beb62e1100bd170d5981cf19df1d4657b25701a08"; reference:url,publicmosaic.com/indicators; sid:9101036; rev:2;)
alert tls $HOME_NET any -> 172.245.155.83 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"23e64b1e39618b19315eb62beb62e1100bd170d5981cf19df1d4657b25701a08"; reference:url,publicmosaic.com/indicators; sid:9101028; rev:2;)
alert tls $HOME_NET any -> 172.245.209.209 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"a51a5a04d7a2217b4e91be635f7d4064e61355a888665e7b8b25aeb6cf66fcd6"; reference:url,publicmosaic.com/indicators; sid:9101023; rev:2;)
alert tls $HOME_NET any -> 172.245.209.209 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"a51a5a04d7a2217b4e91be635f7d4064e61355a888665e7b8b25aeb6cf66fcd6"; reference:url,publicmosaic.com/indicators; sid:9101033; rev:2;)
alert tls $HOME_NET any -> 185.242.3.249 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"d614164a478adf56fe6516e6b7931d2974b6de4aef8dbdf9ccc61fb5acb2b020"; reference:url,publicmosaic.com/indicators; sid:9101281; rev:2;)
alert tls $HOME_NET any -> 192.99.70.186 443 (msg:"HOLLOWPOINT C2 evilginx"; tls.cert_fingerprint; content:"5e1c9493146c24e2741c9b10faa74da4a5e7c9a09d3951f2a52999eaa2034150"; reference:url,publicmosaic.com/indicators; sid:9101707; rev:2;)
alert tls $HOME_NET any -> 192.255.195.141 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"b9a9ca3a0dceb12c09c9e75e3c5bf22bffbcdb39262aaf464b850aa6f88580dc"; reference:url,publicmosaic.com/indicators; sid:9101027; rev:2;)
alert tls $HOME_NET any -> 193.112.176.26 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"7c6eb2eac8bfbffc0354e6808fb89df23435713a325db5d5f554925a020f7a06"; reference:url,publicmosaic.com/indicators; sid:9105794; rev:2;)
alert tls $HOME_NET any -> 194.59.30.96 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"be51d86b1d7d7c07ad5256408dd548049a8de5e776678856588c7846d690a051"; reference:url,publicmosaic.com/indicators; sid:9101328; rev:2;)
alert tls $HOME_NET any -> 194.59.30.96 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"be51d86b1d7d7c07ad5256408dd548049a8de5e776678856588c7846d690a051"; reference:url,publicmosaic.com/indicators; sid:9101327; rev:2;)
alert tls $HOME_NET any -> 196.251.121.137 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"f141f3b3fe2b942b86a0ef24d7d22137ede46d1328c670cdc0862d0f8fbdd1e6"; reference:url,publicmosaic.com/indicators; sid:9101022; rev:2;)
alert tls $HOME_NET any -> 198.23.177.206 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"2eca4348bdcacb07429ede65dd5ff4eb80c3e50a1d608e36a05083ea7fc1eb42"; reference:url,publicmosaic.com/indicators; sid:9101021; rev:2;)
alert tls $HOME_NET any -> 198.23.177.206 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"2eca4348bdcacb07429ede65dd5ff4eb80c3e50a1d608e36a05083ea7fc1eb42"; reference:url,publicmosaic.com/indicators; sid:9101020; rev:2;)
alert tls $HOME_NET any -> 198.23.177.210 7080 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"75d7ca9e050181c2341915c8d42eff29dcbe824530a91b5c768bed7caea5476c"; reference:url,publicmosaic.com/indicators; sid:9101278; rev:2;)
alert tls $HOME_NET any -> 198.23.177.210 7443 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"75d7ca9e050181c2341915c8d42eff29dcbe824530a91b5c768bed7caea5476c"; reference:url,publicmosaic.com/indicators; sid:9101279; rev:2;)
alert tls $HOME_NET any -> 213.152.186.188 32605 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"dea9081b5fbfc8611123f7d7c177ef68ec8f9493fede13b3a29805f9ac5c23ec"; reference:url,publicmosaic.com/indicators; sid:9101516; rev:2;)
alert tls $HOME_NET any -> 213.152.186.188 32635 (msg:"HOLLOWPOINT C2 hype_agent"; tls.cert_fingerprint; content:"dea9081b5fbfc8611123f7d7c177ef68ec8f9493fede13b3a29805f9ac5c23ec"; reference:url,publicmosaic.com/indicators; sid:9101515; rev:2;)