# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 13 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x 9fc0dff954ac_9fc0dff954ac_e440e854f133 — https://publicmosaic.com/ja4x/9fc0dff954ac_9fc0dff954ac_e440e854f133
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 15.204.14.143 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9104159; rev:2;)
alert tls $HOME_NET any -> 15.204.95.228 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9103955; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"31aeea6f8aebf50060f3c88be6a5db22048624cf61306b58e0a184402729d1b3"; reference:url,publicmosaic.com/indicators; sid:9104221; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 57043 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"2ebfe6001235c77f2c59b0774ad241d8073d4359ceb43323c76c2183cf0307f5"; reference:url,publicmosaic.com/indicators; sid:9103350; rev:2;)
alert tls $HOME_NET any -> 18.97.21.97 57143 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"cad765038b0c7f7d02f65ac91600e61bebd301f927372ba870993f0ba97e9195"; reference:url,publicmosaic.com/indicators; sid:9103349; rev:2;)
alert tls $HOME_NET any -> 51.81.171.234 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"50037c0fdb26afebef03491c5fbd827dc9544772c85f817b235b2882f48eacbb"; reference:url,publicmosaic.com/indicators; sid:9104163; rev:2;)
alert tls $HOME_NET any -> 89.125.48.185 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"7dc5f95c8212072c1f1d598c56295624a7e32dae7508243a96980124a40e3860"; reference:url,publicmosaic.com/indicators; sid:9104165; rev:2;)
alert tls $HOME_NET any -> 104.248.156.16 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"0857c9e7d25a6fbc8b269c3bc476a9d37e6de8b381818beb0ea3a689504d8b06"; reference:url,publicmosaic.com/indicators; sid:9106833; rev:2;)
alert tls $HOME_NET any -> 124.221.215.82 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"b9942d1fe1b0e462194b835b46d959a0c6b00844c604b32ee114c965afa1c32e"; reference:url,publicmosaic.com/indicators; sid:9100747; rev:2;)
alert tls $HOME_NET any -> 142.93.88.220 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"69755dc2542b7d7e2117744751933553c615c877be7df0ede6f4fff41b8176ce"; reference:url,publicmosaic.com/indicators; sid:9100578; rev:2;)
alert tls $HOME_NET any -> 146.190.80.105 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"d786e9d07d111f586b8312a6c411917ce0d3810f2ea6f510c70aaad2bae13287"; reference:url,publicmosaic.com/indicators; sid:9105680; rev:2;)
alert tls $HOME_NET any -> 173.249.41.141 40056 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"415603450366b957da78b16b8a34353ca0c5d4d5a7f35d2f4f758d7e106f480e"; reference:url,publicmosaic.com/indicators; sid:9105677; rev:2;)
alert tls $HOME_NET any -> 212.103.26.10 55000 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"010bcd85f0372f86c52b204355df1ebbee8e3eb5e3b32119856486be03637c9e"; reference:url,publicmosaic.com/indicators; sid:9103347; rev:2;)