# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 158 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x a373a9f83c6b_7022c563de38_2e3757343cb0 — https://publicmosaic.com/ja4x/a373a9f83c6b_7022c563de38_2e3757343cb0
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 2.26.124.191 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"a6892faf74c20765621cf08eeaf6e0a2dc6a3faf66df7ffdfda6d8153fddbd89"; reference:url,publicmosaic.com/indicators; sid:9103990; rev:2;)
alert tls $HOME_NET any -> 2.27.13.58 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"7205724774b03e2a6b09fac24e063cffe4bf3e945406690a32e58fa0b5028d71"; reference:url,publicmosaic.com/indicators; sid:9104285; rev:2;)
alert tls $HOME_NET any -> 3.222.180.89 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"db4857641e188b68a7203cac17643603592ac7f6280934e1221e5b8fa73e0185"; reference:url,publicmosaic.com/indicators; sid:9103409; rev:2;)
alert tls $HOME_NET any -> 5.231.106.237 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f7caa9ecaea4b77affd68f5e1816d1ec2de8273974aa86cc4cae59ed3cfe3f3f"; reference:url,publicmosaic.com/indicators; sid:9105809; rev:2;)
alert tls $HOME_NET any -> 13.220.213.63 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d5d09055cd8028006a37424050b137eec1124d187ab82635ba71dd40ce86a452"; reference:url,publicmosaic.com/indicators; sid:9101462; rev:2;)
alert tls $HOME_NET any -> 20.118.221.53 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"59c7b6503aea0ed8b2e046b74b6fcfaf3821f71f57ce98a18088099680aae5ed"; reference:url,publicmosaic.com/indicators; sid:9106444; rev:2;)
alert tls $HOME_NET any -> 20.220.105.236 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e5c9d1aefb6f5a3f570d78972b533fd039c02d93e935ca85a28087d27a99fa63"; reference:url,publicmosaic.com/indicators; sid:9105344; rev:2;)
alert tls $HOME_NET any -> 23.227.196.108 50443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a9c634d83399ce77c0e544847146a571cef4addbe3269a0e88c56a006b9899"; reference:url,publicmosaic.com/indicators; sid:9103414; rev:2;)
alert tls $HOME_NET any -> 23.227.196.108 58443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"56a9c634d83399ce77c0e544847146a571cef4addbe3269a0e88c56a006b9899"; reference:url,publicmosaic.com/indicators; sid:9103413; rev:2;)
alert tls $HOME_NET any -> 27.124.43.141 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101845; rev:2;)
alert tls $HOME_NET any -> 27.124.43.145 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101848; rev:2;)
alert tls $HOME_NET any -> 27.124.43.241 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d6e857ac9aa19f32c8a32c2071519adc6c108f930b70e11f9abe13f6b99ea8a7"; reference:url,publicmosaic.com/indicators; sid:9101844; rev:2;)
alert tls $HOME_NET any -> 31.77.78.18 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c0c1a954a67ddbbab622c8fa00f8e99b454cbe5d92c03a3a692c92757fe75c1e"; reference:url,publicmosaic.com/indicators; sid:9101458; rev:2;)
alert tls $HOME_NET any -> 31.77.78.18 8443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"c0c1a954a67ddbbab622c8fa00f8e99b454cbe5d92c03a3a692c92757fe75c1e"; reference:url,publicmosaic.com/indicators; sid:9101456; rev:2;)
alert tls $HOME_NET any -> 34.21.159.88 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f7f306fba19b7cd7c482db8f3ef967876939741da4a59bfc3d0b0a6cd8d252a3"; reference:url,publicmosaic.com/indicators; sid:9101846; rev:2;)
alert tls $HOME_NET any -> 35.179.92.211 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"dddcb6775c8ce877d14e2c9e09731bb7129fb15100929a2ecd3bebd00bdff70c"; reference:url,publicmosaic.com/indicators; sid:9100678; rev:2;)
alert tls $HOME_NET any -> 38.60.250.235 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"5c2fc5ef5c9aef4902d732d4f5ee9568eb4cced4906bd099790927ea0a37a0ce"; reference:url,publicmosaic.com/indicators; sid:9101847; rev:2;)
alert tls $HOME_NET any -> 38.76.188.210 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1f052e8ae9bed6cad4cd9f452aa481c5f185bdf2e296f226edb3ba49a1e47bb6"; reference:url,publicmosaic.com/indicators; sid:9106828; rev:2;)
alert tls $HOME_NET any -> 38.76.216.18 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"bc8aea6bf2d0ec28542895e0e246abce41ca97e97898acf372c89f8be773684e"; reference:url,publicmosaic.com/indicators; sid:9101839; rev:2;)
alert tls $HOME_NET any -> 38.76.216.85 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"3aec3738c0a8dfe80f99fa0eae93367e39ccb22aa02233651a69b74f29921641"; reference:url,publicmosaic.com/indicators; sid:9101842; rev:2;)
alert tls $HOME_NET any -> 38.95.74.22 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"6c3ca45d8437b90d8fdfe9ee710903309511abceec6561d89ed5dbe470a65041"; reference:url,publicmosaic.com/indicators; sid:9106351; rev:2;)
alert tls $HOME_NET any -> 39.109.101.47 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9871bd61c91d98c19d5a3ff7eb3fe514237acca43595190d9186d4cccb0bc5d2"; reference:url,publicmosaic.com/indicators; sid:9106640; rev:2;)
alert tls $HOME_NET any -> 40.67.146.12 443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"206a64c0ac01d02eb8750d72f88f009339dbc550209060cf1bf5e7f4087c3078"; reference:url,publicmosaic.com/indicators; sid:9104969; rev:2;)
alert tls $HOME_NET any -> 43.98.165.114 443 (msg:"HOLLOWPOINT C2 darksword"; tls.cert_fingerprint; content:"fb5c28e93171fb1abde70a325101b1d8fdcf13e4892ada51042fabcb4f02bb71"; reference:url,publicmosaic.com/indicators; sid:9105964; rev:2;)
alert tls $HOME_NET any -> 43.224.225.243 443 (msg:"HOLLOWPOINT C2 sqlrce"; tls.cert_fingerprint; content:"68cf40fb3dacb23f769fa7e7c6fa04b7b4eaf030e2cb35d3dacb0aa968c53e45"; reference:url,publicmosaic.com/indicators; sid:9101854; rev:2;)
alert tls $HOME_NET any -> 45.61.162.212 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f3eff54da141bab347697bb699c636f0aaa83d8d5f138d1cb71082666e87a0e2"; reference:url,publicmosaic.com/indicators; sid:9100617; rev:2;)
alert tls $HOME_NET any -> 45.61.176.17 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"9723ae3a204ab2a51e8e6376f1ae327e9a5dc26c6912dcb5d074b2b339f6ca13"; reference:url,publicmosaic.com/indicators; sid:9102079; rev:2;)
alert tls $HOME_NET any -> 45.92.158.150 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"f449dc4279a80d763da0b6f76d18ec685809546ee94311b07aaa4f7a00976288"; reference:url,publicmosaic.com/indicators; sid:9106059; rev:2;)
alert tls $HOME_NET any -> 45.136.14.224 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"d2d4b7b44b63a96d20ef1fc926b6800a91007133914fc934057c2493a005d6ab"; reference:url,publicmosaic.com/indicators; sid:9105954; rev:2;)
alert tls $HOME_NET any -> 45.142.142.252 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"62873998e5506d92ab4a1a3ba488d2f1f064175c0701a30a80d1ea7a4fffb320"; reference:url,publicmosaic.com/indicators; sid:9100672; rev:2;)
alert tls $HOME_NET any -> 45.142.143.152 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f1eb2ca305968ad4abac611a6f53ea7c38d0dfdcf40e3b8aea141d5102cd6f72"; reference:url,publicmosaic.com/indicators; sid:9100669; rev:2;)
alert tls $HOME_NET any -> 45.192.167.143 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9105807; rev:2;)
alert tls $HOME_NET any -> 45.192.214.41 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"03c53006380da459c0a7108732a714f92eab9760f6eeb87f5ca0342b53a88e8c"; reference:url,publicmosaic.com/indicators; sid:9103921; rev:2;)
alert tls $HOME_NET any -> 45.192.219.30 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"427cef7f19c1019fa18fd9dd0879f74294da9a3d3810da55b9acb08591c75376"; reference:url,publicmosaic.com/indicators; sid:9105951; rev:2;)
alert tls $HOME_NET any -> 45.192.219.38 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"427cef7f19c1019fa18fd9dd0879f74294da9a3d3810da55b9acb08591c75376"; reference:url,publicmosaic.com/indicators; sid:9105955; rev:2;)
alert tls $HOME_NET any -> 45.192.226.12 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"03c53006380da459c0a7108732a714f92eab9760f6eeb87f5ca0342b53a88e8c"; reference:url,publicmosaic.com/indicators; sid:9103920; rev:2;)
alert tls $HOME_NET any -> 45.194.36.21 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"2a5b40814c306539f2b23c69ade7c4187f7ce6cb929080c64eeee3d7d3b94aa3"; reference:url,publicmosaic.com/indicators; sid:9101841; rev:2;)
alert tls $HOME_NET any -> 52.4.177.142 8443 (msg:"HOLLOWPOINT C2 cobalt_strike"; tls.cert_fingerprint; content:"48bf0f3c036d65d7a1627e564ac06c2ef18f20baafc7ded3d34a512fabc25a96"; reference:url,publicmosaic.com/indicators; sid:9103404; rev:2;)
alert tls $HOME_NET any -> 52.196.120.218 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"4fcb683a3d983b21973d67dd5b76fb52298b393655f1fa1b0b90512b60d91933"; reference:url,publicmosaic.com/indicators; sid:9101836; rev:2;)
alert tls $HOME_NET any -> 54.95.208.190 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a8eea2c59a3ecd38b6bad14800d9c1711afc8ad86c2a99c0ce93e9eaf4e86c32"; reference:url,publicmosaic.com/indicators; sid:9100701; rev:2;)
alert tls $HOME_NET any -> 54.183.237.74 443 (msg:"HOLLOWPOINT C2 vshell"; tls.cert_fingerprint; content:"3c9905697b6d709ada162db0bdcc76a7fef047bb2b07758e7e323125ba9b954e"; reference:url,publicmosaic.com/indicators; sid:9100968; rev:2;)
alert tls $HOME_NET any -> 64.89.161.171 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"b7a8bbffdcd03b9c62f0c0de10a44102d262ce72c25968f916aecdbb1deb5967"; reference:url,publicmosaic.com/indicators; sid:9106573; rev:2;)
alert tls $HOME_NET any -> 64.90.27.50 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"ec3c2cad50ea9ff0e8fe8bf4293d287bf53f85fe6765372d9c31e9f57f774b17"; reference:url,publicmosaic.com/indicators; sid:9101834; rev:2;)
alert tls $HOME_NET any -> 64.90.30.189 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"249bf06f36c829e36615a9140e53e273c4af5994fcee668b73c71eb9830c6b8b"; reference:url,publicmosaic.com/indicators; sid:9101831; rev:2;)
alert tls $HOME_NET any -> 64.90.31.240 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"c399c9739fa8838cef44b879f3cc644e657509c215927a3862ed5f7c511624ac"; reference:url,publicmosaic.com/indicators; sid:9106639; rev:2;)
alert tls $HOME_NET any -> 74.52.15.253 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"2b346091473ea6cbc3629e2bc9f9ed054a2c26e87b575fa81377291d1b36b153"; reference:url,publicmosaic.com/indicators; sid:9105956; rev:2;)
alert tls $HOME_NET any -> 78.13.51.110 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f5147b4a99e46203ca2ca410babd3332eaf73795dc80e249932eda3087e30453"; reference:url,publicmosaic.com/indicators; sid:9101832; rev:2;)
alert tls $HOME_NET any -> 80.66.76.203 443 (msg:"HOLLOWPOINT C2 unam"; tls.cert_fingerprint; content:"95de70375668dd9fa1d4d2c5dec1a66133f413a72fb9dc6b9a0dd1147066baab"; reference:url,publicmosaic.com/indicators; sid:9103344; rev:2;)
alert tls $HOME_NET any -> 80.78.22.202 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"01aa87fee54745537460edf1d2042035b0988fa660f9067904b0db3904057a75"; reference:url,publicmosaic.com/indicators; sid:9105799; rev:2;)
alert tls $HOME_NET any -> 80.78.27.42 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b5eb6a8ee67b7ffd0a6f4ba064b70e5396e445bda5060558bf0b83ed27d0b196"; reference:url,publicmosaic.com/indicators; sid:9100663; rev:2;)
alert tls $HOME_NET any -> 80.85.146.244 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"c0c1a954a67ddbbab622c8fa00f8e99b454cbe5d92c03a3a692c92757fe75c1e"; reference:url,publicmosaic.com/indicators; sid:9101052; rev:2;)
alert tls $HOME_NET any -> 87.251.75.201 443 (msg:"HOLLOWPOINT C2 unam"; tls.cert_fingerprint; content:"b51ed0204bbfbc123709624822dd53ed41b68dcd45d1adbe5bde38f2450ad991"; reference:url,publicmosaic.com/indicators; sid:9103343; rev:2;)
alert tls $HOME_NET any -> 87.251.75.231 443 (msg:"HOLLOWPOINT C2 unam"; tls.cert_fingerprint; content:"9f2c4106a889ebbf7bf23259dc14f4440707c76fb070549b1b827f459ba267ac"; reference:url,publicmosaic.com/indicators; sid:9103342; rev:2;)
alert tls $HOME_NET any -> 89.110.91.35 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b388279394049d37620f27b0abe16bc9080abca406f0d551fca3b188787b49e3"; reference:url,publicmosaic.com/indicators; sid:9104188; rev:2;)
alert tls $HOME_NET any -> 89.127.233.194 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"afa26d0c19d882152f6cae5ed3102a1e783a86bb6a10df4a64ba08e8cc56cd6e"; reference:url,publicmosaic.com/indicators; sid:9106058; rev:2;)
alert tls $HOME_NET any -> 89.169.52.109 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"b01e545d715c22c4afce49cb590732d5a7d378481a994b5863c88ae837b806fd"; reference:url,publicmosaic.com/indicators; sid:9101829; rev:2;)
alert tls $HOME_NET any -> 91.196.162.234 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"a230a74ceaf81a6e34c689a0f3896e6b2393606f61e36fd1d3547ab56e508089"; reference:url,publicmosaic.com/indicators; sid:9102064; rev:2;)
alert tls $HOME_NET any -> 93.95.227.51 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"5675bbcd7dfe6599f5d68837f1fb3470cfc63e59b864b03eeee6bd73ded22839"; reference:url,publicmosaic.com/indicators; sid:9106063; rev:2;)
alert tls $HOME_NET any -> 96.126.179.22 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"bdf1574235613190f5a70244dfbf7ed0a83c4c7447287112d43611d6c5244473"; reference:url,publicmosaic.com/indicators; sid:9101828; rev:2;)
alert tls $HOME_NET any -> 103.40.113.250 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101827; rev:2;)
alert tls $HOME_NET any -> 103.40.113.251 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101824; rev:2;)
alert tls $HOME_NET any -> 103.40.113.253 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101821; rev:2;)
alert tls $HOME_NET any -> 103.40.113.254 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"647be2f309922047baead94e7ff405092b3f95d4ce0db1fc3922d7bc40575495"; reference:url,publicmosaic.com/indicators; sid:9101822; rev:2;)
alert tls $HOME_NET any -> 103.43.71.150 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"a09fe10cb0c5651b97d32b5b3064e2f3480faf5d8589ea82dde3418169902a57"; reference:url,publicmosaic.com/indicators; sid:9106132; rev:2;)
alert tls $HOME_NET any -> 103.52.152.203 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9b53fc9bc85367828503723fff9a87d6f19220be5b9e6f1f3f2704a86d1c85ff"; reference:url,publicmosaic.com/indicators; sid:9101826; rev:2;)
alert tls $HOME_NET any -> 103.112.99.63 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"5fb845ca643ee3650552ed8c4802bcb66401440d728fcfbe2d48746e48d1a35e"; reference:url,publicmosaic.com/indicators; sid:9103919; rev:2;)
alert tls $HOME_NET any -> 103.171.34.111 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"bd1f09c2816550ff17988997b18f4559e813f2b4b6d8ca64aeaddeab358a5f52"; reference:url,publicmosaic.com/indicators; sid:9101825; rev:2;)
alert tls $HOME_NET any -> 103.244.227.157 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"387ec23348067e215d99608b5eb87fb5e6e24c98672090ca04240ff335412d2e"; reference:url,publicmosaic.com/indicators; sid:9106445; rev:2;)
alert tls $HOME_NET any -> 103.249.105.106 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d8a6eb2d94fa45f6a5e834eca5d8b99740900e15b305ac7e3217e8e48a4f8ea"; reference:url,publicmosaic.com/indicators; sid:9101820; rev:2;)
alert tls $HOME_NET any -> 103.249.105.107 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d8a6eb2d94fa45f6a5e834eca5d8b99740900e15b305ac7e3217e8e48a4f8ea"; reference:url,publicmosaic.com/indicators; sid:9101817; rev:2;)
alert tls $HOME_NET any -> 104.129.12.113 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"0dced88d0f04227def6817c0f370d7fad957d5ec5225fb51be1545c3fc6508b4"; reference:url,publicmosaic.com/indicators; sid:9101041; rev:2;)
alert tls $HOME_NET any -> 104.234.172.64 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"9450c6a816f56ef3f8c8d7abd1109d7c6ea42a63856740e049925cae4af29a83"; reference:url,publicmosaic.com/indicators; sid:9103918; rev:2;)
alert tls $HOME_NET any -> 107.173.63.224 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f78b9d8ea35cd9b10d2406e31c2918b66c523a003d791dad14fca84e5912b4bd"; reference:url,publicmosaic.com/indicators; sid:9101814; rev:2;)
alert tls $HOME_NET any -> 107.175.87.234 65321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"091f3fd89c76933c7ead52476f63a93a1341ca1829aeae02ccf5be240a0538c0"; reference:url,publicmosaic.com/indicators; sid:9102184; rev:2;)
alert tls $HOME_NET any -> 108.165.147.100 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"b8882e2040379c3802b3bed7f512dce8f83bc5c018dcbd3757a04292dd488acc"; reference:url,publicmosaic.com/indicators; sid:9101813; rev:2;)
alert tls $HOME_NET any -> 108.165.255.26 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"691e25dab78c241a8b72bb3abdf9d20f18e249ea5b556dab82d40032bcda2389"; reference:url,publicmosaic.com/indicators; sid:9101812; rev:2;)
alert tls $HOME_NET any -> 108.187.1.190 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8bdce35a2bffa6a18276f136ac068a51789368c16e5f673df8f226cd60e9f138"; reference:url,publicmosaic.com/indicators; sid:9101811; rev:2;)
alert tls $HOME_NET any -> 108.187.6.81 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"45bac7bdd83caf1583b3ed28c2d5f812284cc6cc063c9a0f72a26d7de120a6e2"; reference:url,publicmosaic.com/indicators; sid:9106805; rev:2;)
alert tls $HOME_NET any -> 108.187.6.157 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"1fbb6708e2ed2213a30c5efcf1e08ca445b9c77248c09aedd61cdcc2b9fd8a47"; reference:url,publicmosaic.com/indicators; sid:9105953; rev:2;)
alert tls $HOME_NET any -> 108.187.6.166 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"1fbb6708e2ed2213a30c5efcf1e08ca445b9c77248c09aedd61cdcc2b9fd8a47"; reference:url,publicmosaic.com/indicators; sid:9105950; rev:2;)
alert tls $HOME_NET any -> 108.187.7.167 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46bc95551968839d62a95e718d4c110d3940e6887dbb937b318d8658f9d9dfe6"; reference:url,publicmosaic.com/indicators; sid:9103917; rev:2;)
alert tls $HOME_NET any -> 108.187.37.250 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"36f0d9dda0ea06e372ee315741d1d57b974f34437ceea66cda3a8ff44a5ed114"; reference:url,publicmosaic.com/indicators; sid:9105949; rev:2;)
alert tls $HOME_NET any -> 108.187.37.252 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"36f0d9dda0ea06e372ee315741d1d57b974f34437ceea66cda3a8ff44a5ed114"; reference:url,publicmosaic.com/indicators; sid:9106806; rev:2;)
alert tls $HOME_NET any -> 108.187.43.87 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"eb92fbe1ff30fb3736725584d19cabab6a916bda11dee11c4d45ec6a415bbe78"; reference:url,publicmosaic.com/indicators; sid:9101809; rev:2;)
alert tls $HOME_NET any -> 108.187.43.157 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"f959c52ab733ad98135512181b828bc490c58d9c3199f44c41c4e9b103de7ad3"; reference:url,publicmosaic.com/indicators; sid:9103916; rev:2;)
alert tls $HOME_NET any -> 112.121.166.90 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8d63fd0c8387b846788cacab21a41d85052fcb4680e06139bcaa7ead371237dd"; reference:url,publicmosaic.com/indicators; sid:9103924; rev:2;)
alert tls $HOME_NET any -> 112.121.166.92 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8d63fd0c8387b846788cacab21a41d85052fcb4680e06139bcaa7ead371237dd"; reference:url,publicmosaic.com/indicators; sid:9101810; rev:2;)
alert tls $HOME_NET any -> 113.31.118.180 7443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"50c7cfec14dfa2a477e4b7504fde35bd5ff8b969c0d94a8bbdadb25be7392265"; reference:url,publicmosaic.com/indicators; sid:9106057; rev:2;)
alert tls $HOME_NET any -> 114.67.181.248 58195 (msg:"HOLLOWPOINT C2 deimos"; tls.cert_fingerprint; content:"b9b5b09093712ed40ebecbac05df5d8ee6054d56e0c288e2f499d4488d482264"; reference:url,publicmosaic.com/indicators; sid:9103471; rev:2;)
alert tls $HOME_NET any -> 116.213.43.162 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"1580002a56c13d9d9bed8a67531907536db62316d6d846198e2ae62e7f81aaba"; reference:url,publicmosaic.com/indicators; sid:9105958; rev:2;)
alert tls $HOME_NET any -> 128.14.14.188 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d8a6eb2d94fa45f6a5e834eca5d8b99740900e15b305ac7e3217e8e48a4f8ea"; reference:url,publicmosaic.com/indicators; sid:9101808; rev:2;)
alert tls $HOME_NET any -> 138.197.84.20 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"d3f2da36a441c1ccd110229223a7720e00f6d7e76525ea8cb0ceae494181f362"; reference:url,publicmosaic.com/indicators; sid:9102055; rev:2;)
alert tls $HOME_NET any -> 139.99.144.141 443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"2601179921049a7160d1d4dda0784ff9a59e45a1c772d4e4b318ab1778fc7923"; reference:url,publicmosaic.com/indicators; sid:9106062; rev:2;)
alert tls $HOME_NET any -> 143.92.32.198 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"abf64197d32d00d8d87116343843d53887d362b93330620683f5a1f8f3701681"; reference:url,publicmosaic.com/indicators; sid:9101805; rev:2;)
alert tls $HOME_NET any -> 143.92.36.171 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"711241c584fc4b66b18dc6334d61f47ca10068fe7280b4106c1df39232c480bc"; reference:url,publicmosaic.com/indicators; sid:9101799; rev:2;)
alert tls $HOME_NET any -> 143.92.36.176 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"711241c584fc4b66b18dc6334d61f47ca10068fe7280b4106c1df39232c480bc"; reference:url,publicmosaic.com/indicators; sid:9101807; rev:2;)
alert tls $HOME_NET any -> 144.31.106.168 443 (msg:"HOLLOWPOINT C2 chaos"; tls.cert_fingerprint; content:"0acbbbb3a34f03a419145e7bc12cb97984e3885126029dbf2cef62fc1f7524d7"; reference:url,publicmosaic.com/indicators; sid:9101472; rev:2;)
alert tls $HOME_NET any -> 149.88.73.101 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"c87098f9a4efa6e1ed2d39a8217c56ba0f661d4df7ac15811c21e0df444bf6aa"; reference:url,publicmosaic.com/indicators; sid:9101800; rev:2;)
alert tls $HOME_NET any -> 149.104.71.157 8000 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"3d09feccdd6f558cc63beafe4fcdd515d56f1f221563f43a40c3a12c5dfa2198"; reference:url,publicmosaic.com/indicators; sid:9100644; rev:2;)
alert tls $HOME_NET any -> 149.104.71.157 9443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0a8a16097019d0b3ba75508dab91ffcbc4e27e2a3f04c50a84025a738b6443e9"; reference:url,publicmosaic.com/indicators; sid:9100647; rev:2;)
alert tls $HOME_NET any -> 154.213.177.139 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dbc21df8f27373cf3e5549f350255c9357aa2309603e7daefd142c758c516386"; reference:url,publicmosaic.com/indicators; sid:9106637; rev:2;)
alert tls $HOME_NET any -> 154.213.177.154 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dbc21df8f27373cf3e5549f350255c9357aa2309603e7daefd142c758c516386"; reference:url,publicmosaic.com/indicators; sid:9101795; rev:2;)
alert tls $HOME_NET any -> 156.225.18.58 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1f052e8ae9bed6cad4cd9f452aa481c5f185bdf2e296f226edb3ba49a1e47bb6"; reference:url,publicmosaic.com/indicators; sid:9101792; rev:2;)
alert tls $HOME_NET any -> 156.225.26.254 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d569f174971960b7712ad42f5704e6cf5186a9c3b3689286f00766cadfd4058b"; reference:url,publicmosaic.com/indicators; sid:9101791; rev:2;)
alert tls $HOME_NET any -> 161.35.239.147 443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"a2321717f2062d34b83832b83c3c29cdf370edfa6a40b6ddfd57491b586d6ad4"; reference:url,publicmosaic.com/indicators; sid:9100572; rev:2;)
alert tls $HOME_NET any -> 165.227.87.199 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"19c4ecab951fcc5a1e477e4ad9e5623291d2e21e402b3503037e66ae84cd9343"; reference:url,publicmosaic.com/indicators; sid:9103989; rev:2;)
alert tls $HOME_NET any -> 167.71.242.108 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"67a37dc64686fa7ab3816951b7b02ec91c39afc46cf0cb89501ef070957bd57b"; reference:url,publicmosaic.com/indicators; sid:9101034; rev:2;)
alert tls $HOME_NET any -> 179.43.175.26 443 (msg:"HOLLOWPOINT C2 btmob"; tls.cert_fingerprint; content:"583f276a39c6ccdcd3d3f006603abf76ab27cf3a9f136e1a8e8ee342f820dd7a"; reference:url,publicmosaic.com/indicators; sid:9101540; rev:2;)
alert tls $HOME_NET any -> 179.43.175.47 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"97944a0809d78a022c571619d65a2595886555c0f043104b9b85fdd5e321fadf"; reference:url,publicmosaic.com/indicators; sid:9101032; rev:2;)
alert tls $HOME_NET any -> 179.43.175.48 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"97944a0809d78a022c571619d65a2595886555c0f043104b9b85fdd5e321fadf"; reference:url,publicmosaic.com/indicators; sid:9101029; rev:2;)
alert tls $HOME_NET any -> 185.33.86.141 29292 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"0e09ae8ed67191133e1048e363054ef36fc089aa2f26b8db820c937410251145"; reference:url,publicmosaic.com/indicators; sid:9103360; rev:2;)
alert tls $HOME_NET any -> 186.244.227.27 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6b7ab216a08a6ef854a983399222cf1a5f2580bf024c20aaf6914d9243761a3c"; reference:url,publicmosaic.com/indicators; sid:9100451; rev:2;)
alert tls $HOME_NET any -> 186.244.227.52 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6b7ab216a08a6ef854a983399222cf1a5f2580bf024c20aaf6914d9243761a3c"; reference:url,publicmosaic.com/indicators; sid:9100449; rev:2;)
alert tls $HOME_NET any -> 186.244.227.104 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"6b7ab216a08a6ef854a983399222cf1a5f2580bf024c20aaf6914d9243761a3c"; reference:url,publicmosaic.com/indicators; sid:9100450; rev:2;)
alert tls $HOME_NET any -> 189.24.78.208 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8e8886b0680f31c5fc5f421a74f8d0e37c194a9ae1ba393b03c7647ce348b445"; reference:url,publicmosaic.com/indicators; sid:9106636; rev:2;)
alert tls $HOME_NET any -> 192.163.168.3 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"077f2790925065d4f7897c745a1f88615cdc9041e6ca3d26add8e5722c334129"; reference:url,publicmosaic.com/indicators; sid:9106635; rev:2;)
alert tls $HOME_NET any -> 192.163.168.6 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"077f2790925065d4f7897c745a1f88615cdc9041e6ca3d26add8e5722c334129"; reference:url,publicmosaic.com/indicators; sid:9101787; rev:2;)
alert tls $HOME_NET any -> 192.163.168.132 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"357e11630d507ee98e58a03bef8f8659ce7edbf3b27f61e428b6f9e1accaeefc"; reference:url,publicmosaic.com/indicators; sid:9106352; rev:2;)
alert tls $HOME_NET any -> 192.163.168.135 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"357e11630d507ee98e58a03bef8f8659ce7edbf3b27f61e428b6f9e1accaeefc"; reference:url,publicmosaic.com/indicators; sid:9101786; rev:2;)
alert tls $HOME_NET any -> 192.227.221.43 443 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ec6b6a69c3ea0cea7d2652e5cbc7823820af5699f1d2c80b1a91fae854fe7071"; reference:url,publicmosaic.com/indicators; sid:9101025; rev:2;)
alert tls $HOME_NET any -> 192.227.221.43 5173 (msg:"HOLLOWPOINT C2 overlord"; tls.cert_fingerprint; content:"ec6b6a69c3ea0cea7d2652e5cbc7823820af5699f1d2c80b1a91fae854fe7071"; reference:url,publicmosaic.com/indicators; sid:9101030; rev:2;)
alert tls $HOME_NET any -> 192.229.115.141 443 (msg:"HOLLOWPOINT C2 sqlrce"; tls.cert_fingerprint; content:"97d75f3a895dbcc17111659a018fb3f9378983ccaded4aa2d11e85b60190b33f"; reference:url,publicmosaic.com/indicators; sid:9101851; rev:2;)
alert tls $HOME_NET any -> 192.229.115.146 443 (msg:"HOLLOWPOINT C2 sqlrce"; tls.cert_fingerprint; content:"97d75f3a895dbcc17111659a018fb3f9378983ccaded4aa2d11e85b60190b33f"; reference:url,publicmosaic.com/indicators; sid:9101852; rev:2;)
alert tls $HOME_NET any -> 192.229.116.19 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a36361793251110db8513386b3658390e9b5d3f46aff5215a854a228512dc581"; reference:url,publicmosaic.com/indicators; sid:9101783; rev:2;)
alert tls $HOME_NET any -> 192.229.116.34 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a36361793251110db8513386b3658390e9b5d3f46aff5215a854a228512dc581"; reference:url,publicmosaic.com/indicators; sid:9101782; rev:2;)
alert tls $HOME_NET any -> 192.238.134.187 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9101785; rev:2;)
alert tls $HOME_NET any -> 192.238.134.190 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"203975afc29dca98652e487fd40542061fb0db5ccd9f384d8f52db3116607cd8"; reference:url,publicmosaic.com/indicators; sid:9103913; rev:2;)
alert tls $HOME_NET any -> 192.238.162.8 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d01900b7ac7ccbc9119e93501adaaa9540174034c6fb0db2ba51e00210ab7d1"; reference:url,publicmosaic.com/indicators; sid:9101781; rev:2;)
alert tls $HOME_NET any -> 192.238.162.10 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7d01900b7ac7ccbc9119e93501adaaa9540174034c6fb0db2ba51e00210ab7d1"; reference:url,publicmosaic.com/indicators; sid:9101784; rev:2;)
alert tls $HOME_NET any -> 192.252.178.206 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"dd277d53eab335690cc92ad19c9408f937b8d36eda48e167ecee2b470e4c9452"; reference:url,publicmosaic.com/indicators; sid:9101779; rev:2;)
alert tls $HOME_NET any -> 193.134.208.216 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"71cae8a0a932bb6928dcd33cdbccbf2881b0ee50cd00791a8f8a0f99449b689c"; reference:url,publicmosaic.com/indicators; sid:9105957; rev:2;)
alert tls $HOME_NET any -> 193.134.208.222 443 (msg:"HOLLOWPOINT C2 diaoyu_keji"; tls.cert_fingerprint; content:"71cae8a0a932bb6928dcd33cdbccbf2881b0ee50cd00791a8f8a0f99449b689c"; reference:url,publicmosaic.com/indicators; sid:9105952; rev:2;)
alert tls $HOME_NET any -> 194.100.215.101 8100 (msg:"HOLLOWPOINT C2 pyramid_c2"; tls.cert_fingerprint; content:"09d3fc77af49fabebcfc0e882aec0e3820cb2c6f0e3a96f65a9ecc1c3df98276"; reference:url,publicmosaic.com/indicators; sid:9103786; rev:2;)
alert tls $HOME_NET any -> 202.95.22.205 443 (msg:"HOLLOWPOINT C2 btmob"; tls.cert_fingerprint; content:"7b698321a08974faf7d1d419cf1f1e4d0ad12e960a52f9de13e3531f72dbbb8a"; reference:url,publicmosaic.com/indicators; sid:9101538; rev:2;)
alert tls $HOME_NET any -> 202.181.26.220 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"325f4da61419493254cd986f7c1707c886fe588da4d4df6a0865180b2b14b85a"; reference:url,publicmosaic.com/indicators; sid:9101777; rev:2;)
alert tls $HOME_NET any -> 207.56.28.76 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46d505ee1c7a48ee395088b37e4cbc09712cc076bbb1c82de8c0cbbb07adb018"; reference:url,publicmosaic.com/indicators; sid:9101774; rev:2;)
alert tls $HOME_NET any -> 207.56.28.84 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"46d505ee1c7a48ee395088b37e4cbc09712cc076bbb1c82de8c0cbbb07adb018"; reference:url,publicmosaic.com/indicators; sid:9101773; rev:2;)
alert tls $HOME_NET any -> 207.56.28.189 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"949e6ca0bc33f8be4bcf5e01f0719ffe0f9f4ac227581f64912d5ae143a0d40b"; reference:url,publicmosaic.com/indicators; sid:9106633; rev:2;)
alert tls $HOME_NET any -> 207.56.28.225 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"949e6ca0bc33f8be4bcf5e01f0719ffe0f9f4ac227581f64912d5ae143a0d40b"; reference:url,publicmosaic.com/indicators; sid:9105803; rev:2;)
alert tls $HOME_NET any -> 207.56.30.198 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a5f1cd427b6e5db84de6a765e75eb11293fc5821a5a250dbb15cfd9d4b8fab05"; reference:url,publicmosaic.com/indicators; sid:9101771; rev:2;)
alert tls $HOME_NET any -> 207.56.30.219 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"a5f1cd427b6e5db84de6a765e75eb11293fc5821a5a250dbb15cfd9d4b8fab05"; reference:url,publicmosaic.com/indicators; sid:9101769; rev:2;)
alert tls $HOME_NET any -> 207.56.119.21 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8302f74a483379cb2574c161e37b6593529d6010d82b3fd32141a0300bb5197c"; reference:url,publicmosaic.com/indicators; sid:9101770; rev:2;)
alert tls $HOME_NET any -> 207.56.119.35 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d798059ba575718e4b068de1c824fa2db24ff411ce58bbfb958a27321e7fa56b"; reference:url,publicmosaic.com/indicators; sid:9101772; rev:2;)
alert tls $HOME_NET any -> 207.56.119.48 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8412a1de75aad90b989069cd4d09fc97c5a8fb77194317cb427788bed05e8514"; reference:url,publicmosaic.com/indicators; sid:9101761; rev:2;)
alert tls $HOME_NET any -> 207.56.119.80 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"e0db6c08cfb26c614ac9ea7b3306949eb3db5c24f04e06a735aa8001e0a8f962"; reference:url,publicmosaic.com/indicators; sid:9101766; rev:2;)
alert tls $HOME_NET any -> 207.56.119.82 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"d798059ba575718e4b068de1c824fa2db24ff411ce58bbfb958a27321e7fa56b"; reference:url,publicmosaic.com/indicators; sid:9101768; rev:2;)
alert tls $HOME_NET any -> 207.56.119.92 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"1fd0b98e60895cd6e4207376960d21da27cf0433cef663d0204b74cfffdc1649"; reference:url,publicmosaic.com/indicators; sid:9101767; rev:2;)
alert tls $HOME_NET any -> 207.56.119.96 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"98da1e2d366061f244a05c636fe5620b5948b03cf10637cf977f76d52d14f688"; reference:url,publicmosaic.com/indicators; sid:9101759; rev:2;)
alert tls $HOME_NET any -> 207.56.119.123 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8302f74a483379cb2574c161e37b6593529d6010d82b3fd32141a0300bb5197c"; reference:url,publicmosaic.com/indicators; sid:9101760; rev:2;)
alert tls $HOME_NET any -> 207.56.119.139 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"8412a1de75aad90b989069cd4d09fc97c5a8fb77194317cb427788bed05e8514"; reference:url,publicmosaic.com/indicators; sid:9101765; rev:2;)
alert tls $HOME_NET any -> 207.56.119.183 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7da07b37260b9396b553ab51baf46e9e3439227ac5570730c0afba36621808d8"; reference:url,publicmosaic.com/indicators; sid:9106350; rev:2;)
alert tls $HOME_NET any -> 207.56.119.194 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"7da07b37260b9396b553ab51baf46e9e3439227ac5570730c0afba36621808d8"; reference:url,publicmosaic.com/indicators; sid:9101763; rev:2;)
alert tls $HOME_NET any -> 207.56.119.200 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"e0db6c08cfb26c614ac9ea7b3306949eb3db5c24f04e06a735aa8001e0a8f962"; reference:url,publicmosaic.com/indicators; sid:9101758; rev:2;)
alert tls $HOME_NET any -> 207.56.138.49 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"aceb945117e84094314066fca5ffcc779b30d13a477c5e3b75f610ce02e62116"; reference:url,publicmosaic.com/indicators; sid:9101762; rev:2;)
alert tls $HOME_NET any -> 207.56.138.80 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"359fd01dc83f1770c49176c861fce1e6a993f88c1b9f43e3214fadcb8e201f25"; reference:url,publicmosaic.com/indicators; sid:9106632; rev:2;)
alert tls $HOME_NET any -> 207.56.138.97 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"aceb945117e84094314066fca5ffcc779b30d13a477c5e3b75f610ce02e62116"; reference:url,publicmosaic.com/indicators; sid:9101764; rev:2;)
alert tls $HOME_NET any -> 207.56.138.140 443 (msg:"HOLLOWPOINT C2 flying_eagle"; tls.cert_fingerprint; content:"359fd01dc83f1770c49176c861fce1e6a993f88c1b9f43e3214fadcb8e201f25"; reference:url,publicmosaic.com/indicators; sid:9101757; rev:2;)
alert tls $HOME_NET any -> 217.217.97.164 8443 (msg:"HOLLOWPOINT C2 havoc"; tls.cert_fingerprint; content:"1e94951363eb2bd3555aba2f80d0372c0276ad53ef3519730dc3097168135b4b"; reference:url,publicmosaic.com/indicators; sid:9100064; rev:2;)