# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 23 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x c9ed8d15cf91_7022c563de38_0147df7a0c11 — https://publicmosaic.com/ja4x/c9ed8d15cf91_7022c563de38_0147df7a0c11
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 12.187.175.73 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9103826; rev:2;)
alert tls $HOME_NET any -> 12.202.180.13 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9104514; rev:2;)
alert tls $HOME_NET any -> 27.124.17.151 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100059; rev:2;)
alert tls $HOME_NET any -> 27.124.17.164 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100057; rev:2;)
alert tls $HOME_NET any -> 27.124.17.173 8801 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"fa1b61fde12b8ea2541a45625d32a0a4fd0c0392935a3822b0906f8e56f91384"; reference:url,publicmosaic.com/indicators; sid:9100058; rev:2;)
alert tls $HOME_NET any -> 46.151.182.17 5555 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"ea6d84a6d0d2b6fc9cbe474af26dc2f9893050937549119665a192d03f7f9158"; reference:url,publicmosaic.com/indicators; sid:9103822; rev:2;)
alert tls $HOME_NET any -> 47.98.129.153 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100045; rev:2;)
alert tls $HOME_NET any -> 66.175.236.12 5060 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"5d4eca00e629a01c4c611ee28eff4cebfb001789af9edc3d8e56ffde9ce541b7"; reference:url,publicmosaic.com/indicators; sid:9101573; rev:2;)
alert tls $HOME_NET any -> 79.110.49.227 30120 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a6aaa3064f7e438a1bceecce8c8519e61fb4492fba03016673a00313f1d4d28d"; reference:url,publicmosaic.com/indicators; sid:9103821; rev:2;)
alert tls $HOME_NET any -> 91.92.241.38 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"96ab27fd0397c6ce461c71947490e9c3c5c2bacb0f58afd5af50b9fdf23e24b7"; reference:url,publicmosaic.com/indicators; sid:9100423; rev:2;)
alert tls $HOME_NET any -> 102.220.160.231 80 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"015089aba39c0f75b8f0e2752b131fa044de9eed484a9010a374f3e5a6bae889"; reference:url,publicmosaic.com/indicators; sid:9100125; rev:2;)
alert tls $HOME_NET any -> 102.220.160.231 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"015089aba39c0f75b8f0e2752b131fa044de9eed484a9010a374f3e5a6bae889"; reference:url,publicmosaic.com/indicators; sid:9100124; rev:2;)
alert tls $HOME_NET any -> 103.17.185.70 5555 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"c206fbbb02bca6b5358fb4f21d3837ecb6f7d752821a5236ffda42bf84decd15"; reference:url,publicmosaic.com/indicators; sid:9103820; rev:2;)
alert tls $HOME_NET any -> 103.199.100.170 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100122; rev:2;)
alert tls $HOME_NET any -> 103.199.100.171 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100117; rev:2;)
alert tls $HOME_NET any -> 103.199.100.172 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100119; rev:2;)
alert tls $HOME_NET any -> 103.199.100.173 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100121; rev:2;)
alert tls $HOME_NET any -> 103.199.100.174 8848 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"f22577107ae41c3591b0607219544c06ff926e2c67eed94e25f4fdcf3ced810e"; reference:url,publicmosaic.com/indicators; sid:9100118; rev:2;)
alert tls $HOME_NET any -> 108.252.227.16 3001 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"6dc0db7fd80e8b4012130a266f6b50f5e0e66ef52e2abaac3e567281efb96b4d"; reference:url,publicmosaic.com/indicators; sid:9104046; rev:2;)
alert tls $HOME_NET any -> 141.94.121.162 6663 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a19ec99e1870fd21a03c185ab37075100246ba7007b47ccac16d706c19839a8e"; reference:url,publicmosaic.com/indicators; sid:9100178; rev:2;)
alert tls $HOME_NET any -> 141.94.121.162 6667 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"a19ec99e1870fd21a03c185ab37075100246ba7007b47ccac16d706c19839a8e"; reference:url,publicmosaic.com/indicators; sid:9100177; rev:2;)
alert tls $HOME_NET any -> 155.94.150.221 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9104448; rev:2;)
alert tls $HOME_NET any -> 155.94.163.75 7878 (msg:"HOLLOWPOINT C2 dcrat"; tls.cert_fingerprint; content:"1fd87f5a2bdd61c41f38eaf5bd997d1a924262a7f98fa0e85efb122e7872fe86"; reference:url,publicmosaic.com/indicators; sid:9103817; rev:2;)