# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 100 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x a373a9f83c6b_a373a9f83c6b_6361793a4d9e — https://publicmosaic.com/ja4x/a373a9f83c6b_a373a9f83c6b_6361793a4d9e
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 1.117.77.166 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"048564b2df9afdf5dd4051793c3d4eff047d0177ac1e93fcaf41d005b0bd941f"; reference:url,publicmosaic.com/indicators; sid:9102020; rev:2;)
alert tls $HOME_NET any -> 4.230.24.119 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"10de9ec4c5b08e5442973c041e51b3c4f3a1aebd90d546b8dd4d3945d60bee26"; reference:url,publicmosaic.com/indicators; sid:9106196; rev:2;)
alert tls $HOME_NET any -> 8.138.155.217 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"c42695c4ff63883ee728ba386242833bc10745e64f82edc0a45034d11d4eb8b2"; reference:url,publicmosaic.com/indicators; sid:9103962; rev:2;)
alert tls $HOME_NET any -> 8.138.180.67 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b27fa6999e0473f91fab9e9e4b448f79abf4b9b9ca8636cc66d992064ca8f8e8"; reference:url,publicmosaic.com/indicators; sid:9102019; rev:2;)
alert tls $HOME_NET any -> 8.210.120.225 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"f3dd3687e726cc58a6cbdb45922e058519bfab98e005211da39978726d414582"; reference:url,publicmosaic.com/indicators; sid:9102018; rev:2;)
alert tls $HOME_NET any -> 8.210.146.82 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"64a6f180b43e32e16a11368ce4319cc4e7002dbc16c8273cdd5051c4e6f0cd92"; reference:url,publicmosaic.com/indicators; sid:9104231; rev:2;)
alert tls $HOME_NET any -> 8.218.120.126 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"e2cf93dc4d6b36ed574dcbc2e28386e620335d1ccea3f13ba963b68d3ace2a44"; reference:url,publicmosaic.com/indicators; sid:9103763; rev:2;)
alert tls $HOME_NET any -> 8.218.138.77 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"0cd0aa30838af145947e53d0507f1b151a4a6a6037b5009f2f7a2b3aed7fde56"; reference:url,publicmosaic.com/indicators; sid:9104158; rev:2;)
alert tls $HOME_NET any -> 8.218.231.53 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a2a9157ea8d65d1b95690b39ce5698754fbbfb1eba3aa0a8b973f704479f6f9c"; reference:url,publicmosaic.com/indicators; sid:9102017; rev:2;)
alert tls $HOME_NET any -> 18.179.34.241 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"d2a84b84df3cc29c01559b6cd0a3c48fc473bc704c53a776fb258b4864de72d0"; reference:url,publicmosaic.com/indicators; sid:9104055; rev:2;)
alert tls $HOME_NET any -> 20.2.90.98 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"65aece09752865e4abb571f921de9f4cec6d3c27c421022ac0758d154da55ef1"; reference:url,publicmosaic.com/indicators; sid:9102016; rev:2;)
alert tls $HOME_NET any -> 20.2.139.87 6378 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"79f0c4e7b07d606d679e7eb9344a925a1a14a9c7c10c6e9885cab446471c5705"; reference:url,publicmosaic.com/indicators; sid:9102014; rev:2;)
alert tls $HOME_NET any -> 20.2.161.33 6378 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"79f0c4e7b07d606d679e7eb9344a925a1a14a9c7c10c6e9885cab446471c5705"; reference:url,publicmosaic.com/indicators; sid:9103638; rev:2;)
alert tls $HOME_NET any -> 20.89.182.93 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"586cebb74acbe060eb8f57c4fda193d29655e2dad286980dd11e97c3fcd77633"; reference:url,publicmosaic.com/indicators; sid:9104235; rev:2;)
alert tls $HOME_NET any -> 20.196.147.118 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"665beb25ab526df019b93c2421c7e8972310439518719f05127d578df4c8cc62"; reference:url,publicmosaic.com/indicators; sid:9102013; rev:2;)
alert tls $HOME_NET any -> 20.255.154.56 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"65aece09752865e4abb571f921de9f4cec6d3c27c421022ac0758d154da55ef1"; reference:url,publicmosaic.com/indicators; sid:9102012; rev:2;)
alert tls $HOME_NET any -> 23.94.199.11 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"54b0f32fa0d2a5d11c93914e4b195d535e6c1ebb1b29218bf3a8a136b81f7d0a"; reference:url,publicmosaic.com/indicators; sid:9102011; rev:2;)
alert tls $HOME_NET any -> 23.95.148.136 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3fa0edbf0315b1fd8fa813f643fac1d09703ec623adc71a637250f394080c5f6"; reference:url,publicmosaic.com/indicators; sid:9103607; rev:2;)
alert tls $HOME_NET any -> 23.95.242.55 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"c1ab3f27443ccfcbc6eb228f0d292a5b4761f42879cc50b68b7a0215833dc87f"; reference:url,publicmosaic.com/indicators; sid:9104210; rev:2;)
alert tls $HOME_NET any -> 34.55.91.26 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"ed46923dc889e41520aaa84b8f7314e7805f1908725d8d8c14cfcbbddf65441e"; reference:url,publicmosaic.com/indicators; sid:9106779; rev:2;)
alert tls $HOME_NET any -> 34.96.225.28 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"39ee4aeb38ac570c2a780143bc97742e1998fce40a9b900dae0d1316b9b10135"; reference:url,publicmosaic.com/indicators; sid:9102010; rev:2;)
alert tls $HOME_NET any -> 38.147.170.252 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"69373af9fc6110aa2c10044c9554da3f885b516e77431b057b9b78a8614f3401"; reference:url,publicmosaic.com/indicators; sid:9102009; rev:2;)
alert tls $HOME_NET any -> 39.102.87.142 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3fcada07c918a0553903f4cd1522c727fd3c52368d8ca0b029886f7396ed7011"; reference:url,publicmosaic.com/indicators; sid:9104202; rev:2;)
alert tls $HOME_NET any -> 40.124.184.160 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"cfca26fde7c6d85d00961fa89e8f094a6bb5d8bf7eedf62a3ba8bb96ae9204ea"; reference:url,publicmosaic.com/indicators; sid:9102008; rev:2;)
alert tls $HOME_NET any -> 40.124.184.160 8443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"cfca26fde7c6d85d00961fa89e8f094a6bb5d8bf7eedf62a3ba8bb96ae9204ea"; reference:url,publicmosaic.com/indicators; sid:9101738; rev:2;)
alert tls $HOME_NET any -> 43.155.168.253 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"9219cb59d585eb917615ea75d189f48895ce2fa98764f29c6633b3350a68c3bb"; reference:url,publicmosaic.com/indicators; sid:9100149; rev:2;)
alert tls $HOME_NET any -> 43.161.234.96 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"c4b748c50b2267aa93b38d4b882b1496d3c06b193effc2b3207922fcad2fb82f"; reference:url,publicmosaic.com/indicators; sid:9102007; rev:2;)
alert tls $HOME_NET any -> 43.246.210.148 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"c74bef0ab72eceb82c5da2667c260013e09e27f19c7c71b4e2869557a21ba780"; reference:url,publicmosaic.com/indicators; sid:9102006; rev:2;)
alert tls $HOME_NET any -> 45.8.46.122 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"4e1fe90d94978bf95394abbcff4db3eae4b661c108327eb923540f971fa68ccc"; reference:url,publicmosaic.com/indicators; sid:9100142; rev:2;)
alert tls $HOME_NET any -> 45.145.228.16 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a270434eba01fcaa09a9953050dff2f2b15004e27b3446e01ade61b93edb6cf4"; reference:url,publicmosaic.com/indicators; sid:9104233; rev:2;)
alert tls $HOME_NET any -> 45.145.228.142 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a918e8c08ffc1fcee6d8f29ee1a7d06c738d20a8be4e7b9c30d4b3dceb29dd"; reference:url,publicmosaic.com/indicators; sid:9102005; rev:2;)
alert tls $HOME_NET any -> 45.221.118.69 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3425ee411220b2caecd686b55570073d854ce1cf5a9e5f45fb3c707dd266f4fa"; reference:url,publicmosaic.com/indicators; sid:9104455; rev:2;)
alert tls $HOME_NET any -> 47.96.125.204 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"4bbd0a45b0df375d15f385ea9636cd2e20b73903f7da3128c6166414e78ffda5"; reference:url,publicmosaic.com/indicators; sid:9104208; rev:2;)
alert tls $HOME_NET any -> 54.95.7.136 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"af5b14567b6c30749bcfa058f82edb4332e41f4a457d64244758e55e89cbfe8c"; reference:url,publicmosaic.com/indicators; sid:9106354; rev:2;)
alert tls $HOME_NET any -> 64.185.233.162 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"7e249a77faf74b0f3768cf40eaf46ce253c302656f31067dbcf22f0bfb839b33"; reference:url,publicmosaic.com/indicators; sid:9102004; rev:2;)
alert tls $HOME_NET any -> 64.185.233.163 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"7e249a77faf74b0f3768cf40eaf46ce253c302656f31067dbcf22f0bfb839b33"; reference:url,publicmosaic.com/indicators; sid:9102003; rev:2;)
alert tls $HOME_NET any -> 64.185.233.164 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"7e249a77faf74b0f3768cf40eaf46ce253c302656f31067dbcf22f0bfb839b33"; reference:url,publicmosaic.com/indicators; sid:9102002; rev:2;)
alert tls $HOME_NET any -> 64.185.233.166 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"7e249a77faf74b0f3768cf40eaf46ce253c302656f31067dbcf22f0bfb839b33"; reference:url,publicmosaic.com/indicators; sid:9102001; rev:2;)
alert tls $HOME_NET any -> 66.154.106.44 8001 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"aef91270c4a15610a716744c49920450737a8f2044e7e41fbb9469be63397e24"; reference:url,publicmosaic.com/indicators; sid:9102000; rev:2;)
alert tls $HOME_NET any -> 72.11.148.165 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"bbc14d5222a952961c4082ab4263509eabbb216cde7ac9cd9ef13d2b7b5f878a"; reference:url,publicmosaic.com/indicators; sid:9101999; rev:2;)
alert tls $HOME_NET any -> 82.23.246.97 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b59a3b634bc96f4e2ec002048d16214a068995a6c05193c636b629fda61a7eb0"; reference:url,publicmosaic.com/indicators; sid:9101998; rev:2;)
alert tls $HOME_NET any -> 82.23.246.123 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b59a3b634bc96f4e2ec002048d16214a068995a6c05193c636b629fda61a7eb0"; reference:url,publicmosaic.com/indicators; sid:9103967; rev:2;)
alert tls $HOME_NET any -> 82.23.246.164 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b59a3b634bc96f4e2ec002048d16214a068995a6c05193c636b629fda61a7eb0"; reference:url,publicmosaic.com/indicators; sid:9101997; rev:2;)
alert tls $HOME_NET any -> 82.23.246.186 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b59a3b634bc96f4e2ec002048d16214a068995a6c05193c636b629fda61a7eb0"; reference:url,publicmosaic.com/indicators; sid:9101996; rev:2;)
alert tls $HOME_NET any -> 94.156.119.209 8080 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3adaf569386423d52681a75e268d2cef3be5ead12667a75aa7c66b94c7f4ef51"; reference:url,publicmosaic.com/indicators; sid:9104463; rev:2;)
alert tls $HOME_NET any -> 94.156.119.224 8080 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3adaf569386423d52681a75e268d2cef3be5ead12667a75aa7c66b94c7f4ef51"; reference:url,publicmosaic.com/indicators; sid:9104462; rev:2;)
alert tls $HOME_NET any -> 101.37.210.236 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"bdd6a453bdb4113cc7249dc4a7dcd3449769c0cdd2328042fd96785e24b9213f"; reference:url,publicmosaic.com/indicators; sid:9104198; rev:2;)
alert tls $HOME_NET any -> 101.42.104.134 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"129ffcef7e1924ab29f85b409d1ce5dd85babf1c84fa8d8b0c1fa4f516e96a22"; reference:url,publicmosaic.com/indicators; sid:9103762; rev:2;)
alert tls $HOME_NET any -> 101.133.172.90 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1ec1d907300d4a85c6113622e51055a9b8e598d73e15fc1664e4036bb9bad2b4"; reference:url,publicmosaic.com/indicators; sid:9104054; rev:2;)
alert tls $HOME_NET any -> 103.43.18.10 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"fa690f6477762dc62ca140abbf84a5961c48e5d753010f72f1a029438424ad4c"; reference:url,publicmosaic.com/indicators; sid:9104051; rev:2;)
alert tls $HOME_NET any -> 103.43.71.150 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"5b453ef5b6e0c5d2171b56bdd1632385c7296605d220d61e85c43d2d884654f9"; reference:url,publicmosaic.com/indicators; sid:9104204; rev:2;)
alert tls $HOME_NET any -> 103.87.10.156 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"08e8f76ae6174c46f80a037803199096e53cf2e63d33617c72368f57105201c3"; reference:url,publicmosaic.com/indicators; sid:9104991; rev:2;)
alert tls $HOME_NET any -> 103.195.188.38 38887 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1c629edbe3642a759562e60e8531d7660468ff55ba39bae999bcab0b5edda4b8"; reference:url,publicmosaic.com/indicators; sid:9103620; rev:2;)
alert tls $HOME_NET any -> 103.231.254.57 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"337a0094157cbfc52c4c0fb9f9762a670043485cd268b530bef4b38bdd0d80ec"; reference:url,publicmosaic.com/indicators; sid:9101739; rev:2;)
alert tls $HOME_NET any -> 103.231.254.57 2096 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"337a0094157cbfc52c4c0fb9f9762a670043485cd268b530bef4b38bdd0d80ec"; reference:url,publicmosaic.com/indicators; sid:9101994; rev:2;)
alert tls $HOME_NET any -> 103.233.8.39 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"fae324d985ba0ec04183a2b17318cb248c0f6c64ef5b4a14ff9a5da4beeaab64"; reference:url,publicmosaic.com/indicators; sid:9104212; rev:2;)
alert tls $HOME_NET any -> 103.233.8.46 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"fae324d985ba0ec04183a2b17318cb248c0f6c64ef5b4a14ff9a5da4beeaab64"; reference:url,publicmosaic.com/indicators; sid:9104226; rev:2;)
alert tls $HOME_NET any -> 104.214.176.148 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"8b7c493ef2d13f29d4461ca64254cf5960e4c592028ade294b7b4773953bf6a1"; reference:url,publicmosaic.com/indicators; sid:9101993; rev:2;)
alert tls $HOME_NET any -> 104.214.176.148 9527 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"8b7c493ef2d13f29d4461ca64254cf5960e4c592028ade294b7b4773953bf6a1"; reference:url,publicmosaic.com/indicators; sid:9101992; rev:2;)
alert tls $HOME_NET any -> 107.148.2.52 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a38636c3216675227b37b8262f7d45dcce13f54ef3bdbbcfbb231b425aab2405"; reference:url,publicmosaic.com/indicators; sid:9101991; rev:2;)
alert tls $HOME_NET any -> 107.173.71.55 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"751eb524a0eab32ed7fa3f41a1f05599d1019424300c62b60207ea0cefa21a42"; reference:url,publicmosaic.com/indicators; sid:9101990; rev:2;)
alert tls $HOME_NET any -> 107.173.221.204 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3d50cde71b375cc4db6d882384e0cf0f1e7246b8a2ec25de4790f21e0d036053"; reference:url,publicmosaic.com/indicators; sid:9101989; rev:2;)
alert tls $HOME_NET any -> 107.173.221.204 8530 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"3d50cde71b375cc4db6d882384e0cf0f1e7246b8a2ec25de4790f21e0d036053"; reference:url,publicmosaic.com/indicators; sid:9101988; rev:2;)
alert tls $HOME_NET any -> 107.189.28.92 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"420d38f2c36779dea948efc5dec09d60cb39ecb971928ec986abe5249635ce1c"; reference:url,publicmosaic.com/indicators; sid:9101987; rev:2;)
alert tls $HOME_NET any -> 110.40.147.249 3333 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"fe62321a1cca3709af6235140036076b014083e751a7a58a00bee67f5e8f8faa"; reference:url,publicmosaic.com/indicators; sid:9104510; rev:2;)
alert tls $HOME_NET any -> 113.45.238.149 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"5c6f16525aef0e976d40c982ebc9677986547005615e208e67627b5994abe034"; reference:url,publicmosaic.com/indicators; sid:9102292; rev:2;)
alert tls $HOME_NET any -> 115.191.18.57 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a40fa08f3c1e3b059de495941c866b8d5a84ee3978835ec875d4c75b818a9a96"; reference:url,publicmosaic.com/indicators; sid:9103968; rev:2;)
alert tls $HOME_NET any -> 117.72.38.14 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1e45dd529d8d8cb8bf101a197b52128d145b2878d9e97952dbac7243922818b3"; reference:url,publicmosaic.com/indicators; sid:9102291; rev:2;)
alert tls $HOME_NET any -> 117.72.72.254 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"da248368bf997b800cefde72afb20bba6cd4afe98c6e754ca7c03573123e6bca"; reference:url,publicmosaic.com/indicators; sid:9104060; rev:2;)
alert tls $HOME_NET any -> 117.72.202.93 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"9d0770e174b8c378c22a44ced46e248700d25dde4441f31a05e8c4fb4412f501"; reference:url,publicmosaic.com/indicators; sid:9102290; rev:2;)
alert tls $HOME_NET any -> 117.72.209.125 3333 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"e3e81c5210e77732fed9beed3f694fa309b40a76d80d3acc5bc9f5d3a4787b1b"; reference:url,publicmosaic.com/indicators; sid:9102289; rev:2;)
alert tls $HOME_NET any -> 118.107.44.140 2096 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"266bb301d68f378fdee90ee79ecff4d3aca2c5ca97b98ca1b508b59a744d7fb7"; reference:url,publicmosaic.com/indicators; sid:9102288; rev:2;)
alert tls $HOME_NET any -> 118.107.44.149 2096 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"266bb301d68f378fdee90ee79ecff4d3aca2c5ca97b98ca1b508b59a744d7fb7"; reference:url,publicmosaic.com/indicators; sid:9102287; rev:2;)
alert tls $HOME_NET any -> 118.107.44.162 2096 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"266bb301d68f378fdee90ee79ecff4d3aca2c5ca97b98ca1b508b59a744d7fb7"; reference:url,publicmosaic.com/indicators; sid:9102286; rev:2;)
alert tls $HOME_NET any -> 118.195.130.210 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"757d4b38e1e0d1863b66d197afe9e7308c1ac1d2050563b027f7c7a938c4fc3f"; reference:url,publicmosaic.com/indicators; sid:9102285; rev:2;)
alert tls $HOME_NET any -> 119.45.190.210 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"6c126ef9e9a06807edd39d5315e8ea87dacb51a03eafaea0c9c7a0f01c6afbb2"; reference:url,publicmosaic.com/indicators; sid:9102284; rev:2;)
alert tls $HOME_NET any -> 123.56.48.58 8999 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"a3664e76cdc7e8153bb2f0f0bcad98b4fe570623b16b9d762fbb8aa51b13597e"; reference:url,publicmosaic.com/indicators; sid:9102213; rev:2;)
alert tls $HOME_NET any -> 124.221.221.58 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"9c29af7d072b473b31d02e6b303e2a477c18d6c6db8abf590c18762bbbdf8be0"; reference:url,publicmosaic.com/indicators; sid:9102283; rev:2;)
alert tls $HOME_NET any -> 124.248.66.207 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"5b9eda45772db8f6b38896aa42fa9348a991a455a71ca22ab8b4b0cd16877c4d"; reference:url,publicmosaic.com/indicators; sid:9104173; rev:2;)
alert tls $HOME_NET any -> 134.122.153.121 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"16c0033299d245fcc6ad9472c00d6450c495b31b326bc32471fecb321b7fc8ed"; reference:url,publicmosaic.com/indicators; sid:9103978; rev:2;)
alert tls $HOME_NET any -> 140.143.130.157 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"2a029da6e6e5288fb7230da0d2701bbbd8ec4faa04bf6109c262cd75832e164f"; reference:url,publicmosaic.com/indicators; sid:9103761; rev:2;)
alert tls $HOME_NET any -> 143.92.60.13 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a80484a6e9f8e44d3e4f4d46f017c1aea57e1ae4a214c34bfeeabec15228e3"; reference:url,publicmosaic.com/indicators; sid:9102282; rev:2;)
alert tls $HOME_NET any -> 143.92.60.24 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a80484a6e9f8e44d3e4f4d46f017c1aea57e1ae4a214c34bfeeabec15228e3"; reference:url,publicmosaic.com/indicators; sid:9104508; rev:2;)
alert tls $HOME_NET any -> 143.92.60.26 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"86a80484a6e9f8e44d3e4f4d46f017c1aea57e1ae4a214c34bfeeabec15228e3"; reference:url,publicmosaic.com/indicators; sid:9101737; rev:2;)
alert tls $HOME_NET any -> 152.42.180.208 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1cbe87bcea1ec835b1df1ebb65f808478babb56715de65a3100db59d1a10385d"; reference:url,publicmosaic.com/indicators; sid:9102281; rev:2;)
alert tls $HOME_NET any -> 152.136.56.105 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"87b762d04a1794a7df42e8b1500598ecf095eaf3a512303c93909cb64893b5ca"; reference:url,publicmosaic.com/indicators; sid:9104451; rev:2;)
alert tls $HOME_NET any -> 156.225.26.28 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"07c0087513a67b4b3b0a3fd35f8e6c872668f46e9442168a6af55b30fa9b5898"; reference:url,publicmosaic.com/indicators; sid:9104003; rev:2;)
alert tls $HOME_NET any -> 156.247.40.80 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b59a3b634bc96f4e2ec002048d16214a068995a6c05193c636b629fda61a7eb0"; reference:url,publicmosaic.com/indicators; sid:9102280; rev:2;)
alert tls $HOME_NET any -> 183.60.226.2 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"f52f37ac8ecc6a771efa84eb424b0d08df76eb976d8ac4182e2cf4adb8fc28fa"; reference:url,publicmosaic.com/indicators; sid:9101983; rev:2;)
alert tls $HOME_NET any -> 185.25.50.109 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"77b155e78acfede78c5a5f5e7a5d4b422cd847cada3bf6eae19cbd5cbb91931a"; reference:url,publicmosaic.com/indicators; sid:9101982; rev:2;)
alert tls $HOME_NET any -> 192.3.84.131 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"d9b23c9d340cd2e477ef8130ba43adef7550e335920872c754d0a54e0ba64de7"; reference:url,publicmosaic.com/indicators; sid:9101981; rev:2;)
alert tls $HOME_NET any -> 192.3.84.131 8570 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"d9b23c9d340cd2e477ef8130ba43adef7550e335920872c754d0a54e0ba64de7"; reference:url,publicmosaic.com/indicators; sid:9101980; rev:2;)
alert tls $HOME_NET any -> 192.3.134.25 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"422fd06a4732b81196a5a4ff1706f3e2fd077e095ae73a5cdb48c30475ab3823"; reference:url,publicmosaic.com/indicators; sid:9101979; rev:2;)
alert tls $HOME_NET any -> 192.144.32.213 443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"f4bfcbadf8e0ee8ec9d7c09c2e822dc3973959d9719c88089aa72a12b7d39758"; reference:url,publicmosaic.com/indicators; sid:9101736; rev:2;)
alert tls $HOME_NET any -> 192.144.32.213 2095 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"f4bfcbadf8e0ee8ec9d7c09c2e822dc3973959d9719c88089aa72a12b7d39758"; reference:url,publicmosaic.com/indicators; sid:9101978; rev:2;)
alert tls $HOME_NET any -> 192.144.32.213 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"f4bfcbadf8e0ee8ec9d7c09c2e822dc3973959d9719c88089aa72a12b7d39758"; reference:url,publicmosaic.com/indicators; sid:9101977; rev:2;)
alert tls $HOME_NET any -> 192.210.248.125 9030 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"b942da41bc459768dd164b14108fff17e3c8ad7b5bfa7fc9831c439aa69c99ab"; reference:url,publicmosaic.com/indicators; sid:9101976; rev:2;)
alert tls $HOME_NET any -> 192.227.223.69 3232 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"5b1caf2c1b58438fac5c7ca19a6c01fc19afe18cff79ca9679f6328cf9a79234"; reference:url,publicmosaic.com/indicators; sid:9101975; rev:2;)
alert tls $HOME_NET any -> 193.37.213.238 8443 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"cfb881a63b14cb5aa10feb751419f047ec6cd3c3ec9c484ce40f45519cbd9aa7"; reference:url,publicmosaic.com/indicators; sid:9101598; rev:2;)
alert tls $HOME_NET any -> 207.57.123.251 80 (msg:"HOLLOWPOINT C2 reversessh"; tls.cert_fingerprint; content:"1f1b9271a9517be93a91d39d44830b952eef8406350f277e2a07a25da097c634"; reference:url,publicmosaic.com/indicators; sid:9101974; rev:2;)