# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 25 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x b757977db3a9_b757977db3a9_e1926048963f — https://publicmosaic.com/ja4x/b757977db3a9_b757977db3a9_e1926048963f
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 4.246.219.92 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"8f0b807d31abdc301112e7ec40ddeba57c5cb1cface080146d999aa2c12f876b"; reference:url,publicmosaic.com/indicators; sid:9101697; rev:2;)
alert tls $HOME_NET any -> 8.221.103.101 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"a76ac0185fa8ce94ba6162d1f0b94b027ea571a31652609e963a0a40a588f2ea"; reference:url,publicmosaic.com/indicators; sid:9101700; rev:2;)
alert tls $HOME_NET any -> 15.237.123.87 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0e2b20a9ba0c02f023445286996b1920d88dff77e85769d1adb3d097d54d8c5f"; reference:url,publicmosaic.com/indicators; sid:9101698; rev:2;)
alert tls $HOME_NET any -> 20.115.112.185 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"3d0147473d7c167021f749fb47b37cece531a30885bea177e395ff7938b86026"; reference:url,publicmosaic.com/indicators; sid:9101696; rev:2;)
alert tls $HOME_NET any -> 20.206.67.182 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"b50f8fa45462a3fa82c325b9d1adf957eb5fd8b8b9f703b8924341e9c05507be"; reference:url,publicmosaic.com/indicators; sid:9101695; rev:2;)
alert tls $HOME_NET any -> 20.206.67.182 2083 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"b50f8fa45462a3fa82c325b9d1adf957eb5fd8b8b9f703b8924341e9c05507be"; reference:url,publicmosaic.com/indicators; sid:9101694; rev:2;)
alert tls $HOME_NET any -> 47.89.175.103 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"8681653c2987fc4f66efd1c9460465f8646b838839b6ca4e7b4057ce9ba7787c"; reference:url,publicmosaic.com/indicators; sid:9101693; rev:2;)
alert tls $HOME_NET any -> 77.232.43.48 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"d434f02322d04a8f92308b231f56b1b8f566f4407515c1455503fa4a6b80aa52"; reference:url,publicmosaic.com/indicators; sid:9101692; rev:2;)
alert tls $HOME_NET any -> 104.171.138.204 80 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"6668ad29f81e61c3779bb847c3443ec17bf2d41aec2add7baa69ca8faa1b95db"; reference:url,publicmosaic.com/indicators; sid:9101691; rev:2;)
alert tls $HOME_NET any -> 104.207.73.57 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0792204c7e078c3215b8fb64b9b7c8a01bf7f2fcef27c6f42d0e28c1b332d762"; reference:url,publicmosaic.com/indicators; sid:9105021; rev:2;)
alert tls $HOME_NET any -> 104.211.21.237 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0cb6f12e4024ce87f9a4feebb36b67782e8fb9bb2e352498b63a3e3ab2d62fbe"; reference:url,publicmosaic.com/indicators; sid:9101690; rev:2;)
alert tls $HOME_NET any -> 114.67.181.248 443 (msg:"HOLLOWPOINT C2 deimos"; tls.cert_fingerprint; content:"1071347c58ce1cc0bc31d2f4ef6d9e7ed1957a3c6a6032738331831bd73f8c14"; reference:url,publicmosaic.com/indicators; sid:9106655; rev:2;)
alert tls $HOME_NET any -> 160.187.199.134 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9101689; rev:2;)
alert tls $HOME_NET any -> 160.187.199.160 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9104500; rev:2;)
alert tls $HOME_NET any -> 160.187.199.189 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9103865; rev:2;)
alert tls $HOME_NET any -> 160.187.199.189 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9101688; rev:2;)
alert tls $HOME_NET any -> 160.187.199.190 8000 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"264374a985a225bfa39a07b43db1f5773d3572516fd08aeda51843edf705b361"; reference:url,publicmosaic.com/indicators; sid:9103866; rev:2;)
alert tls $HOME_NET any -> 172.174.29.141 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"d66ca9ff5dff583d9fe49230b7a29e835e5b5981cb4d7fa232fd5c213de43c2c"; reference:url,publicmosaic.com/indicators; sid:9101687; rev:2;)
alert tls $HOME_NET any -> 193.37.213.238 443 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"0506430b3fcd911acd89ac0a747b8c60f78d4c1852ea57c1620e30a2bebfa3a8"; reference:url,publicmosaic.com/indicators; sid:9103864; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 8766 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9106826; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 9003 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9100552; rev:2;)
alert tls $HOME_NET any -> 203.83.238.164 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"028be334f7d6668ccd8994a8161f9fff2e3da5d7ef4378c94d5e6d662c519347"; reference:url,publicmosaic.com/indicators; sid:9100546; rev:2;)
alert tls $HOME_NET any -> 217.6.46.91 11601 (msg:"HOLLOWPOINT exposed tool ligolo"; tls.cert_fingerprint; content:"3a80505f69983a72b47f444245a43899bd49e00aa09733b1e717d994d5b6fbb1"; reference:url,publicmosaic.com/indicators; sid:9101686; rev:2;)
alert tls $HOME_NET any -> 220.154.3.197 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"06b22b08b071b67b81574190c79463b637571fd197f0f1ab67ca56f7460f81c7"; reference:url,publicmosaic.com/indicators; sid:9100548; rev:2;)
alert tls $HOME_NET any -> 220.154.128.196 9443 (msg:"HOLLOWPOINT C2 mythic"; tls.cert_fingerprint; content:"65e5046fec12df1137c99104cbbe62dac0cd0fd20e908fdc9a2fd4bdc315ebfc"; reference:url,publicmosaic.com/indicators; sid:9101151; rev:2;)