# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 7 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: ja4x e7bc7ebc3d9e_e7bc7ebc3d9e_a704c60b6818 — https://publicmosaic.com/ja4x/e7bc7ebc3d9e_e7bc7ebc3d9e_a704c60b6818
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tls $HOME_NET any -> 51.68.216.211 443 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"42b809b02b4a1aae78bd7d7241698addb526fbea8ffcd39d39e488f4517349b2"; reference:url,publicmosaic.com/indicators; sid:9103884; rev:2;)
alert tls $HOME_NET any -> 85.11.167.9 8443 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"4ca87b5c407caa7fc2aed9accf16092986fb3cc8f23bff00915698316782a860"; reference:url,publicmosaic.com/indicators; sid:9103759; rev:2;)
alert tls $HOME_NET any -> 85.208.69.45 80 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"758eb7b708bce9ea08e5f19a53b46f2e708baa2f61c0e549274855db0aaec9b2"; reference:url,publicmosaic.com/indicators; sid:9103758; rev:2;)
alert tls $HOME_NET any -> 85.208.69.45 443 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"bccb62b1fbf53653cc79bbf8b9f161525840b931dfe7e2767fa2aa5fdc89d37a"; reference:url,publicmosaic.com/indicators; sid:9103757; rev:2;)
alert tls $HOME_NET any -> 104.243.33.83 8443 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"9a0258ff450819134807b89bb3b0d2964793f16eb99dee21a065de1d4d54fe0f"; reference:url,publicmosaic.com/indicators; sid:9101566; rev:2;)
alert tls $HOME_NET any -> 198.100.154.163 8443 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"ecc932a64f0322dfc778ac28b3d63030802c022bbf5a513479abe2da6b049db2"; reference:url,publicmosaic.com/indicators; sid:9103756; rev:2;)
alert tls $HOME_NET any -> 198.100.154.163 8444 (msg:"HOLLOWPOINT C2 bianlian"; tls.cert_fingerprint; content:"7446507ef6814c22d13c28d34b4d31fe1cf43061dfb61c14d224ff650caeca62"; reference:url,publicmosaic.com/indicators; sid:9103755; rev:2;)