# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 17 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: payload 020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0 — https://publicmosaic.com/payload/020f1fa6072108c79ed6f553f4f8b08e157bf17f9c260a76353300230fed09f0
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 136
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 27.147.196.138 22320 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104898; rev:2;)
alert tcp $HOME_NET any -> 36.89.62.19 63814 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104986; rev:2;)
alert tcp $HOME_NET any -> 77.238.209.82 26331 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104931; rev:2;)
alert tcp $HOME_NET any -> 81.16.249.96 46703 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104883; rev:2;)
alert tcp $HOME_NET any -> 89.216.107.99 65414 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104882; rev:2;)
alert tcp $HOME_NET any -> 91.92.82.180 17789 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104707; rev:2;)
alert tcp $HOME_NET any -> 93.87.42.154 40955 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104705; rev:2;)
alert tcp $HOME_NET any -> 103.90.206.87 4419 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104880; rev:2;)
alert tcp $HOME_NET any -> 103.217.215.238 17645 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9105011; rev:2;)
alert tcp $HOME_NET any -> 139.255.97.116 6983 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104806; rev:2;)
alert tcp $HOME_NET any -> 178.188.30.171 14759 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104955; rev:2;)
alert tcp $HOME_NET any -> 181.129.100.123 30581 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104869; rev:2;)
alert tcp $HOME_NET any -> 183.81.156.125 12929 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104784; rev:2;)
alert tcp $HOME_NET any -> 186.138.107.5 14491 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104863; rev:2;)
alert tcp $HOME_NET any -> 202.152.42.227 54741 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104937; rev:2;)
alert tcp $HOME_NET any -> 203.201.160.122 14409 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104757; rev:2;)
alert tcp $HOME_NET any -> 212.73.75.84 60761 (msg:"HOLLOWPOINT infected device hajime"; reference:url,publicmosaic.com/indicators; sid:9104963; rev:2;)