# hollowpoint.rules — generated 2026-09-15 10:08 UTC — 14 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x c9d784bbb12e_c9d784bbb12e_795797892f9c — https://publicmosaic.com/ja4x/c9d784bbb12e_c9d784bbb12e_795797892f9c
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 8.136.13.87 7001 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d65b05391566a3d4ee3039cdcaaaa2bfee286eef9e364b39b405ead3eabb2926"; reference:url,publicmosaic.com/indicators; sid:9101261; rev:2;)
alert tls $HOME_NET any -> 20.118.221.53 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"5e9b002658c37ea18c1bb54d51597a124fbe8a4c4cbc1888c593c89fdaaa12ab"; reference:url,publicmosaic.com/indicators; sid:9105544; rev:2;)
alert tls $HOME_NET any -> 31.220.93.222 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"d4584baf214871605ca530f61dd69126969a270602a095a7619f1397fd07e283"; reference:url,publicmosaic.com/indicators; sid:9100474; rev:2;)
alert tls $HOME_NET any -> 38.54.8.74 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"a7d3a614a14c509a3d4b7eb7bc90ed02cf6ea3f312d66ff9edb48f134198057a"; reference:url,publicmosaic.com/indicators; sid:9100473; rev:2;)
alert tls $HOME_NET any -> 66.179.30.218 65432 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b9ed6c118650b4b7ca8f673f11d6deaf95e1ef6de7b3cec5bf7e8d0a00c1bb2b"; reference:url,publicmosaic.com/indicators; sid:9105535; rev:2;)
alert tls $HOME_NET any -> 94.102.49.164 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b5bccddecb4b6c2698ec0418d70264de99678e60a02ed07013a38e1516e49298"; reference:url,publicmosaic.com/indicators; sid:9105141; rev:2;)
alert tls $HOME_NET any -> 103.253.212.216 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"aeb920ea6ebad2a37e1e3491aac86206b02d8df5ecff27a3b11fe50f77793279"; reference:url,publicmosaic.com/indicators; sid:9106443; rev:2;)
alert tls $HOME_NET any -> 109.237.64.48 44704 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"b5224e70a742c909548f1b68cd4a8940574be7d4f557f31463c5a5e8dd9985cf"; reference:url,publicmosaic.com/indicators; sid:9104498; rev:2;)
alert tls $HOME_NET any -> 149.50.135.215 49152 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"f363c55ffc1530a12e45263934dddd7a779472937d29880543b7836f456e3567"; reference:url,publicmosaic.com/indicators; sid:9100463; rev:2;)
alert tls $HOME_NET any -> 149.202.227.107 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"4df1befb045ec1aeda258abb8e10c3509a74c6eec0005eddb7d5f9d2e4bfb05b"; reference:url,publicmosaic.com/indicators; sid:9100462; rev:2;)
alert tls $HOME_NET any -> 162.14.124.25 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e580e149b5b2307ec5ca3b694c95bbdd02b696e3fab1b7ced19ad1e7c1bc7bb1"; reference:url,publicmosaic.com/indicators; sid:9100459; rev:2;)
alert tls $HOME_NET any -> 167.254.241.29 443 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"1c95129415df45b5dec5276a78fa0a2084a7f4d4d6f1d2bf6ee18bad75ea9c98"; reference:url,publicmosaic.com/indicators; sid:9100796; rev:2;)
alert tls $HOME_NET any -> 192.3.139.18 15221 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"649a78c13fe1d2f5d905ed4e178a8d994138829868f5260fed7eed3e66e8d954"; reference:url,publicmosaic.com/indicators; sid:9103358; rev:2;)
alert tls $HOME_NET any -> 198.13.51.245 4321 (msg:"HOLLOWPOINT C2 adaptix"; tls.cert_fingerprint; content:"e580e149b5b2307ec5ca3b694c95bbdd02b696e3fab1b7ced19ad1e7c1bc7bb1"; reference:url,publicmosaic.com/indicators; sid:9101881; rev:2;)