# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 385 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: payload 12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef — https://publicmosaic.com/payload/12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 15
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 1.61.151.195 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105295; rev:2;)
alert tcp $HOME_NET any -> 1.61.202.234 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101880; rev:2;)
alert tcp $HOME_NET any -> 27.12.220.94 58619 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106769; rev:2;)
alert tcp $HOME_NET any -> 27.152.10.10 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103411; rev:2;)
alert tcp $HOME_NET any -> 27.153.152.10 40052 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103746; rev:2;)
alert tcp $HOME_NET any -> 27.203.158.156 60406 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103745; rev:2;)
alert tcp $HOME_NET any -> 27.218.236.119 47733 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101879; rev:2;)
alert tcp $HOME_NET any -> 27.222.48.192 43573 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103744; rev:2;)
alert tcp $HOME_NET any -> 27.222.89.207 48083 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103743; rev:2;)
alert tcp $HOME_NET any -> 31.129.0.57 56485 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103742; rev:2;)
alert tcp $HOME_NET any -> 36.64.184.26 46567 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104920; rev:2;)
alert tcp $HOME_NET any -> 36.64.184.26 51647 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106143; rev:2;)
alert tcp $HOME_NET any -> 36.68.93.208 57750 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106278; rev:2;)
alert tcp $HOME_NET any -> 36.69.76.83 47847 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105846; rev:2;)
alert tcp $HOME_NET any -> 36.70.111.17 52592 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106386; rev:2;)
alert tcp $HOME_NET any -> 36.71.24.86 38254 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105064; rev:2;)
alert tcp $HOME_NET any -> 36.71.26.92 52208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105284; rev:2;)
alert tcp $HOME_NET any -> 36.77.230.229 47127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106004; rev:2;)
alert tcp $HOME_NET any -> 36.88.136.194 53727 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106544; rev:2;)
alert tcp $HOME_NET any -> 36.89.252.178 36257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106142; rev:2;)
alert tcp $HOME_NET any -> 37.78.38.173 50492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105283; rev:2;)
alert tcp $HOME_NET any -> 38.58.200.25 40355 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106277; rev:2;)
alert tcp $HOME_NET any -> 38.75.202.173 44405 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106385; rev:2;)
alert tcp $HOME_NET any -> 39.65.202.109 51237 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101878; rev:2;)
alert tcp $HOME_NET any -> 39.80.60.21 60792 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103741; rev:2;)
alert tcp $HOME_NET any -> 39.84.95.142 46029 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101877; rev:2;)
alert tcp $HOME_NET any -> 39.88.200.53 34933 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103740; rev:2;)
alert tcp $HOME_NET any -> 42.177.122.244 34345 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103860; rev:2;)
alert tcp $HOME_NET any -> 42.233.210.159 59519 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101876; rev:2;)
alert tcp $HOME_NET any -> 42.243.252.236 59708 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106532; rev:2;)
alert tcp $HOME_NET any -> 45.165.172.92 51435 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106531; rev:2;)
alert tcp $HOME_NET any -> 45.171.177.193 36258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103859; rev:2;)
alert tcp $HOME_NET any -> 45.172.218.181 46033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106116; rev:2;)
alert tcp $HOME_NET any -> 45.172.218.181 57007 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104141; rev:2;)
alert tcp $HOME_NET any -> 45.177.32.104 36577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104280; rev:2;)
alert tcp $HOME_NET any -> 45.177.33.169 55300 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101875; rev:2;)
alert tcp $HOME_NET any -> 45.186.77.55 34939 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103739; rev:2;)
alert tcp $HOME_NET any -> 45.233.94.135 34363 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103738; rev:2;)
alert tcp $HOME_NET any -> 46.158.168.35 50492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101874; rev:2;)
alert tcp $HOME_NET any -> 47.22.166.163 56510 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101873; rev:2;)
alert tcp $HOME_NET any -> 47.208.139.29 48393 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103753; rev:2;)
alert tcp $HOME_NET any -> 47.212.193.38 44155 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103752; rev:2;)
alert tcp $HOME_NET any -> 58.22.18.152 33899 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103751; rev:2;)
alert tcp $HOME_NET any -> 58.22.210.127 46509 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106271; rev:2;)
alert tcp $HOME_NET any -> 58.37.101.152 39822 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103750; rev:2;)
alert tcp $HOME_NET any -> 60.6.62.96 59328 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106269; rev:2;)
alert tcp $HOME_NET any -> 60.184.107.9 37858 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105606; rev:2;)
alert tcp $HOME_NET any -> 60.184.138.242 45870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105281; rev:2;)
alert tcp $HOME_NET any -> 60.215.197.174 38401 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101892; rev:2;)
alert tcp $HOME_NET any -> 60.216.131.62 43868 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101872; rev:2;)
alert tcp $HOME_NET any -> 61.216.49.127 49370 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104143; rev:2;)
alert tcp $HOME_NET any -> 66.212.173.225 55933 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106714; rev:2;)
alert tcp $HOME_NET any -> 66.212.187.214 45901 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106286; rev:2;)
alert tcp $HOME_NET any -> 69.173.180.110 39821 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104140; rev:2;)
alert tcp $HOME_NET any -> 77.247.88.88 46996 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103749; rev:2;)
alert tcp $HOME_NET any -> 81.230.148.181 51631 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103748; rev:2;)
alert tcp $HOME_NET any -> 82.144.86.37 47425 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106776; rev:2;)
alert tcp $HOME_NET any -> 82.144.86.37 56329 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104950; rev:2;)
alert tcp $HOME_NET any -> 85.173.24.109 50492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104279; rev:2;)
alert tcp $HOME_NET any -> 87.15.14.109 59208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103909; rev:2;)
alert tcp $HOME_NET any -> 91.240.165.44 48222 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103747; rev:2;)
alert tcp $HOME_NET any -> 94.27.145.11 37216 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105062; rev:2;)
alert tcp $HOME_NET any -> 94.244.36.34 34585 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101871; rev:2;)
alert tcp $HOME_NET any -> 94.244.36.34 42903 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104949; rev:2;)
alert tcp $HOME_NET any -> 95.9.35.137 43208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103908; rev:2;)
alert tcp $HOME_NET any -> 95.56.232.109 45950 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101893; rev:2;)
alert tcp $HOME_NET any -> 101.29.22.214 59328 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104540; rev:2;)
alert tcp $HOME_NET any -> 101.59.79.119 40390 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104539; rev:2;)
alert tcp $HOME_NET any -> 101.59.79.119 44883 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106527; rev:2;)
alert tcp $HOME_NET any -> 101.108.6.60 33547 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105269; rev:2;)
alert tcp $HOME_NET any -> 101.108.8.2 60608 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106711; rev:2;)
alert tcp $HOME_NET any -> 101.108.69.64 50943 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106526; rev:2;)
alert tcp $HOME_NET any -> 101.108.253.190 58711 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105268; rev:2;)
alert tcp $HOME_NET any -> 103.18.13.54 47482 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105267; rev:2;)
alert tcp $HOME_NET any -> 103.44.137.13 48345 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106264; rev:2;)
alert tcp $HOME_NET any -> 103.80.57.126 57047 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103879; rev:2;)
alert tcp $HOME_NET any -> 103.156.176.162 53592 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105266; rev:2;)
alert tcp $HOME_NET any -> 103.249.199.1 35620 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101894; rev:2;)
alert tcp $HOME_NET any -> 105.184.31.171 41073 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103878; rev:2;)
alert tcp $HOME_NET any -> 105.184.34.115 49289 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106435; rev:2;)
alert tcp $HOME_NET any -> 105.184.42.145 36337 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104076; rev:2;)
alert tcp $HOME_NET any -> 105.184.91.101 41339 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101870; rev:2;)
alert tcp $HOME_NET any -> 105.184.105.108 53225 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105297; rev:2;)
alert tcp $HOME_NET any -> 105.184.177.144 55771 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106154; rev:2;)
alert tcp $HOME_NET any -> 105.184.180.148 36857 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106381; rev:2;)
alert tcp $HOME_NET any -> 105.184.232.230 54381 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105841; rev:2;)
alert tcp $HOME_NET any -> 105.184.248.13 58983 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105604; rev:2;)
alert tcp $HOME_NET any -> 105.186.83.56 41911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103858; rev:2;)
alert tcp $HOME_NET any -> 105.186.83.83 55579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105059; rev:2;)
alert tcp $HOME_NET any -> 105.186.112.68 48101 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103857; rev:2;)
alert tcp $HOME_NET any -> 105.186.189.253 52445 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105058; rev:2;)
alert tcp $HOME_NET any -> 105.186.220.180 42471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106709; rev:2;)
alert tcp $HOME_NET any -> 105.187.26.237 37077 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103856; rev:2;)
alert tcp $HOME_NET any -> 105.187.32.75 37955 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106708; rev:2;)
alert tcp $HOME_NET any -> 105.224.34.139 60105 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106262; rev:2;)
alert tcp $HOME_NET any -> 105.224.60.250 44945 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106554; rev:2;)
alert tcp $HOME_NET any -> 105.224.242.127 37969 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106113; rev:2;)
alert tcp $HOME_NET any -> 105.225.48.83 57349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103803; rev:2;)
alert tcp $HOME_NET any -> 105.225.86.238 41431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101895; rev:2;)
alert tcp $HOME_NET any -> 106.1.9.225 50153 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104947; rev:2;)
alert tcp $HOME_NET any -> 106.40.242.20 46263 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104917; rev:2;)
alert tcp $HOME_NET any -> 106.57.6.80 53331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101896; rev:2;)
alert tcp $HOME_NET any -> 106.57.7.26 53331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104534; rev:2;)
alert tcp $HOME_NET any -> 109.236.44.241 37805 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106261; rev:2;)
alert tcp $HOME_NET any -> 109.236.46.215 59913 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101868; rev:2;)
alert tcp $HOME_NET any -> 110.136.98.236 48232 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104946; rev:2;)
alert tcp $HOME_NET any -> 110.136.99.36 46081 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103855; rev:2;)
alert tcp $HOME_NET any -> 110.138.3.140 53454 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103877; rev:2;)
alert tcp $HOME_NET any -> 110.186.228.150 48917 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101897; rev:2;)
alert tcp $HOME_NET any -> 110.186.231.170 38543 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105265; rev:2;)
alert tcp $HOME_NET any -> 111.185.147.232 59432 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101867; rev:2;)
alert tcp $HOME_NET any -> 112.109.197.47 41093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105264; rev:2;)
alert tcp $HOME_NET any -> 112.113.68.159 41597 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104041; rev:2;)
alert tcp $HOME_NET any -> 112.198.128.164 47005 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106434; rev:2;)
alert tcp $HOME_NET any -> 112.198.130.112 42547 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104040; rev:2;)
alert tcp $HOME_NET any -> 112.198.193.5 40399 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104278; rev:2;)
alert tcp $HOME_NET any -> 112.198.238.18 46799 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104277; rev:2;)
alert tcp $HOME_NET any -> 112.198.238.30 44431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104945; rev:2;)
alert tcp $HOME_NET any -> 112.237.49.125 43123 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104079; rev:2;)
alert tcp $HOME_NET any -> 112.254.25.161 51093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103737; rev:2;)
alert tcp $HOME_NET any -> 112.254.26.64 51093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106705; rev:2;)
alert tcp $HOME_NET any -> 113.206.10.45 47047 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106523; rev:2;)
alert tcp $HOME_NET any -> 113.221.24.213 45414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103774; rev:2;)
alert tcp $HOME_NET any -> 113.221.25.216 37532 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105263; rev:2;)
alert tcp $HOME_NET any -> 113.221.38.108 40790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106285; rev:2;)
alert tcp $HOME_NET any -> 113.221.44.37 55307 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106259; rev:2;)
alert tcp $HOME_NET any -> 113.221.45.157 55307 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106704; rev:2;)
alert tcp $HOME_NET any -> 113.221.46.118 58353 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104139; rev:2;)
alert tcp $HOME_NET any -> 113.221.46.119 40057 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104138; rev:2;)
alert tcp $HOME_NET any -> 113.221.76.194 54955 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103736; rev:2;)
alert tcp $HOME_NET any -> 114.198.242.174 38879 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106153; rev:2;)
alert tcp $HOME_NET any -> 114.226.119.232 44763 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101898; rev:2;)
alert tcp $HOME_NET any -> 114.227.56.205 36941 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104276; rev:2;)
alert tcp $HOME_NET any -> 114.227.64.129 43953 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103773; rev:2;)
alert tcp $HOME_NET any -> 114.227.64.149 56600 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106258; rev:2;)
alert tcp $HOME_NET any -> 114.227.68.181 36904 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106111; rev:2;)
alert tcp $HOME_NET any -> 114.228.141.185 33800 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104142; rev:2;)
alert tcp $HOME_NET any -> 114.228.186.181 50519 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104538; rev:2;)
alert tcp $HOME_NET any -> 114.231.138.67 44129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105010; rev:2;)
alert tcp $HOME_NET any -> 114.239.63.214 39292 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106703; rev:2;)
alert tcp $HOME_NET any -> 115.49.107.36 60965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106110; rev:2;)
alert tcp $HOME_NET any -> 115.51.108.246 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104275; rev:2;)
alert tcp $HOME_NET any -> 115.51.123.229 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106702; rev:2;)
alert tcp $HOME_NET any -> 115.51.180.51 37431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103849; rev:2;)
alert tcp $HOME_NET any -> 115.58.178.178 33235 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106107; rev:2;)
alert tcp $HOME_NET any -> 115.58.180.245 33235 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104914; rev:2;)
alert tcp $HOME_NET any -> 115.58.253.176 36067 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106516; rev:2;)
alert tcp $HOME_NET any -> 115.59.231.52 49670 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106250; rev:2;)
alert tcp $HOME_NET any -> 115.61.107.195 57147 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103772; rev:2;)
alert tcp $HOME_NET any -> 115.96.130.110 40029 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106552; rev:2;)
alert tcp $HOME_NET any -> 115.192.97.236 47571 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104990; rev:2;)
alert tcp $HOME_NET any -> 115.193.205.187 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104533; rev:2;)
alert tcp $HOME_NET any -> 115.194.8.14 57404 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106514; rev:2;)
alert tcp $HOME_NET any -> 115.205.150.31 37201 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106513; rev:2;)
alert tcp $HOME_NET any -> 115.230.76.101 37221 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106151; rev:2;)
alert tcp $HOME_NET any -> 116.68.162.210 60207 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106512; rev:2;)
alert tcp $HOME_NET any -> 116.248.83.141 56727 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106511; rev:2;)
alert tcp $HOME_NET any -> 117.63.74.133 39063 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105254; rev:2;)
alert tcp $HOME_NET any -> 117.63.112.125 41376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104274; rev:2;)
alert tcp $HOME_NET any -> 117.131.92.150 59473 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103876; rev:2;)
alert tcp $HOME_NET any -> 118.232.137.101 58455 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106360; rev:2;)
alert tcp $HOME_NET any -> 119.73.59.113 51110 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106510; rev:2;)
alert tcp $HOME_NET any -> 119.73.59.113 60742 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106246; rev:2;)
alert tcp $HOME_NET any -> 119.73.59.113 60801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105120; rev:2;)
alert tcp $HOME_NET any -> 119.116.121.152 35357 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103850; rev:2;)
alert tcp $HOME_NET any -> 119.166.194.8 35798 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101865; rev:2;)
alert tcp $HOME_NET any -> 119.179.30.73 48215 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101883; rev:2;)
alert tcp $HOME_NET any -> 119.184.4.100 48083 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105037; rev:2;)
alert tcp $HOME_NET any -> 120.28.135.4 35562 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106695; rev:2;)
alert tcp $HOME_NET any -> 120.28.139.121 50861 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104273; rev:2;)
alert tcp $HOME_NET any -> 120.28.144.161 39233 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105639; rev:2;)
alert tcp $HOME_NET any -> 120.28.161.11 57965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104024; rev:2;)
alert tcp $HOME_NET any -> 120.28.161.60 57495 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106694; rev:2;)
alert tcp $HOME_NET any -> 120.28.166.185 48483 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106105; rev:2;)
alert tcp $HOME_NET any -> 120.28.189.248 42675 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101899; rev:2;)
alert tcp $HOME_NET any -> 120.28.189.248 50610 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105249; rev:2;)
alert tcp $HOME_NET any -> 120.28.193.113 47346 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105248; rev:2;)
alert tcp $HOME_NET any -> 120.28.193.113 53964 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106507; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 38048 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104137; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 41877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103771; rev:2;)
alert tcp $HOME_NET any -> 120.28.194.30 51325 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105247; rev:2;)
alert tcp $HOME_NET any -> 120.28.196.250 50536 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106693; rev:2;)
alert tcp $HOME_NET any -> 120.28.197.69 36816 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105246; rev:2;)
alert tcp $HOME_NET any -> 120.28.197.69 53898 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106692; rev:2;)
alert tcp $HOME_NET any -> 120.28.199.24 36535 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101900; rev:2;)
alert tcp $HOME_NET any -> 120.28.200.110 33040 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105119; rev:2;)
alert tcp $HOME_NET any -> 120.28.201.138 54526 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106506; rev:2;)
alert tcp $HOME_NET any -> 120.28.201.138 55930 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105656; rev:2;)
alert tcp $HOME_NET any -> 120.28.212.172 40293 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105245; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.36 39145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106244; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.50 47233 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104281; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.116 56895 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106243; rev:2;)
alert tcp $HOME_NET any -> 120.28.215.200 60458 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104272; rev:2;)
alert tcp $HOME_NET any -> 120.28.219.231 49376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106242; rev:2;)
alert tcp $HOME_NET any -> 121.61.49.44 46204 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104136; rev:2;)
alert tcp $HOME_NET any -> 121.231.116.192 38256 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106691; rev:2;)
alert tcp $HOME_NET any -> 122.99.60.138 56774 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103854; rev:2;)
alert tcp $HOME_NET any -> 122.139.13.133 53319 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106690; rev:2;)
alert tcp $HOME_NET any -> 122.139.18.141 39877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104135; rev:2;)
alert tcp $HOME_NET any -> 122.233.29.62 38332 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104038; rev:2;)
alert tcp $HOME_NET any -> 122.241.130.212 45870 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104037; rev:2;)
alert tcp $HOME_NET any -> 123.15.67.95 37431 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104271; rev:2;)
alert tcp $HOME_NET any -> 123.132.166.255 41245 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101864; rev:2;)
alert tcp $HOME_NET any -> 123.132.245.94 33681 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104134; rev:2;)
alert tcp $HOME_NET any -> 123.161.90.221 49111 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101901; rev:2;)
alert tcp $HOME_NET any -> 123.172.56.34 44140 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103735; rev:2;)
alert tcp $HOME_NET any -> 123.173.73.226 41793 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103734; rev:2;)
alert tcp $HOME_NET any -> 123.245.97.124 58336 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104532; rev:2;)
alert tcp $HOME_NET any -> 123.245.99.52 39875 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103770; rev:2;)
alert tcp $HOME_NET any -> 123.252.17.79 41354 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103732; rev:2;)
alert tcp $HOME_NET any -> 124.6.165.86 60366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106377; rev:2;)
alert tcp $HOME_NET any -> 124.6.167.121 45202 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103657; rev:2;)
alert tcp $HOME_NET any -> 124.6.167.121 57352 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104537; rev:2;)
alert tcp $HOME_NET any -> 124.6.168.74 42130 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105240; rev:2;)
alert tcp $HOME_NET any -> 124.6.169.46 58258 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104036; rev:2;)
alert tcp $HOME_NET any -> 124.6.185.132 48257 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103731; rev:2;)
alert tcp $HOME_NET any -> 124.135.10.58 51825 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103650; rev:2;)
alert tcp $HOME_NET any -> 124.161.116.2 39053 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105296; rev:2;)
alert tcp $HOME_NET any -> 124.234.131.24 53745 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106376; rev:2;)
alert tcp $HOME_NET any -> 124.234.219.141 44247 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106684; rev:2;)
alert tcp $HOME_NET any -> 124.235.106.150 39827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103730; rev:2;)
alert tcp $HOME_NET any -> 124.235.130.21 59252 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103852; rev:2;)
alert tcp $HOME_NET any -> 125.43.5.41 34827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106500; rev:2;)
alert tcp $HOME_NET any -> 125.43.8.244 34827 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101902; rev:2;)
alert tcp $HOME_NET any -> 125.65.146.164 50215 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101903; rev:2;)
alert tcp $HOME_NET any -> 125.78.40.165 45145 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104270; rev:2;)
alert tcp $HOME_NET any -> 125.106.114.59 42629 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106375; rev:2;)
alert tcp $HOME_NET any -> 125.119.75.223 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106374; rev:2;)
alert tcp $HOME_NET any -> 125.126.115.194 35284 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106753; rev:2;)
alert tcp $HOME_NET any -> 125.160.139.10 40058 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104035; rev:2;)
alert tcp $HOME_NET any -> 125.160.142.97 33577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106499; rev:2;)
alert tcp $HOME_NET any -> 130.12.209.132 49060 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106237; rev:2;)
alert tcp $HOME_NET any -> 130.12.209.147 43312 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101863; rev:2;)
alert tcp $HOME_NET any -> 138.204.196.244 59781 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105236; rev:2;)
alert tcp $HOME_NET any -> 138.204.196.254 45562 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101904; rev:2;)
alert tcp $HOME_NET any -> 154.223.128.222 33167 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106498; rev:2;)
alert tcp $HOME_NET any -> 154.223.128.222 48066 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105118; rev:2;)
alert tcp $HOME_NET any -> 157.66.146.183 44492 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105835; rev:2;)
alert tcp $HOME_NET any -> 160.250.51.11 37175 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106778; rev:2;)
alert tcp $HOME_NET any -> 160.250.51.11 53906 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106139; rev:2;)
alert tcp $HOME_NET any -> 167.250.158.32 46664 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101862; rev:2;)
alert tcp $HOME_NET any -> 170.84.132.250 39933 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104531; rev:2;)
alert tcp $HOME_NET any -> 170.84.132.250 59150 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106373; rev:2;)
alert tcp $HOME_NET any -> 170.254.10.213 35081 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104909; rev:2;)
alert tcp $HOME_NET any -> 175.0.60.188 40182 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103729; rev:2;)
alert tcp $HOME_NET any -> 175.9.132.63 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106497; rev:2;)
alert tcp $HOME_NET any -> 175.9.165.183 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105234; rev:2;)
alert tcp $HOME_NET any -> 175.9.166.233 50484 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104033; rev:2;)
alert tcp $HOME_NET any -> 175.30.114.108 44656 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104871; rev:2;)
alert tcp $HOME_NET any -> 175.31.168.229 50764 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106682; rev:2;)
alert tcp $HOME_NET any -> 175.43.85.192 57642 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106159; rev:2;)
alert tcp $HOME_NET any -> 175.43.151.10 40697 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106282; rev:2;)
alert tcp $HOME_NET any -> 175.44.156.36 37033 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103728; rev:2;)
alert tcp $HOME_NET any -> 175.153.135.75 53709 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106431; rev:2;)
alert tcp $HOME_NET any -> 177.84.28.156 44034 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105056; rev:2;)
alert tcp $HOME_NET any -> 177.86.229.12 53455 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101861; rev:2;)
alert tcp $HOME_NET any -> 179.154.80.249 53339 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106681; rev:2;)
alert tcp $HOME_NET any -> 180.104.55.42 40721 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104908; rev:2;)
alert tcp $HOME_NET any -> 180.107.123.227 46139 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105033; rev:2;)
alert tcp $HOME_NET any -> 180.115.67.118 58208 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105116; rev:2;)
alert tcp $HOME_NET any -> 180.115.168.174 34414 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101884; rev:2;)
alert tcp $HOME_NET any -> 180.116.71.179 36941 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103727; rev:2;)
alert tcp $HOME_NET any -> 180.120.0.49 44129 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106235; rev:2;)
alert tcp $HOME_NET any -> 180.190.185.100 51007 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104530; rev:2;)
alert tcp $HOME_NET any -> 180.190.186.97 52355 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104269; rev:2;)
alert tcp $HOME_NET any -> 180.190.240.131 55186 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106496; rev:2;)
alert tcp $HOME_NET any -> 180.191.16.206 48801 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103726; rev:2;)
alert tcp $HOME_NET any -> 180.191.22.170 52866 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103851; rev:2;)
alert tcp $HOME_NET any -> 180.191.32.197 49164 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104034; rev:2;)
alert tcp $HOME_NET any -> 180.191.34.236 40802 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106437; rev:2;)
alert tcp $HOME_NET any -> 180.191.34.236 57057 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101905; rev:2;)
alert tcp $HOME_NET any -> 180.191.36.99 55946 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101906; rev:2;)
alert tcp $HOME_NET any -> 180.191.40.108 46389 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104133; rev:2;)
alert tcp $HOME_NET any -> 180.191.42.15 44577 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103725; rev:2;)
alert tcp $HOME_NET any -> 180.191.49.27 47666 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106138; rev:2;)
alert tcp $HOME_NET any -> 180.244.47.60 40341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106680; rev:2;)
alert tcp $HOME_NET any -> 180.244.61.239 60849 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104268; rev:2;)
alert tcp $HOME_NET any -> 180.245.43.93 37596 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101860; rev:2;)
alert tcp $HOME_NET any -> 180.252.221.56 45321 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106679; rev:2;)
alert tcp $HOME_NET any -> 182.116.64.244 57147 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105233; rev:2;)
alert tcp $HOME_NET any -> 182.120.43.111 47591 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104032; rev:2;)
alert tcp $HOME_NET any -> 182.122.193.170 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103769; rev:2;)
alert tcp $HOME_NET any -> 182.122.195.174 51347 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105595; rev:2;)
alert tcp $HOME_NET any -> 182.146.222.251 41175 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104075; rev:2;)
alert tcp $HOME_NET any -> 182.240.8.122 58787 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105228; rev:2;)
alert tcp $HOME_NET any -> 182.240.10.30 58787 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106546; rev:2;)
alert tcp $HOME_NET any -> 183.23.136.70 54790 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104267; rev:2;)
alert tcp $HOME_NET any -> 183.23.136.171 35951 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104132; rev:2;)
alert tcp $HOME_NET any -> 183.63.8.194 50991 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103724; rev:2;)
alert tcp $HOME_NET any -> 183.134.152.81 38332 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105226; rev:2;)
alert tcp $HOME_NET any -> 183.150.79.222 42629 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104529; rev:2;)
alert tcp $HOME_NET any -> 183.150.141.1 57127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103848; rev:2;)
alert tcp $HOME_NET any -> 183.150.205.192 57127 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105225; rev:2;)
alert tcp $HOME_NET any -> 183.151.171.156 58331 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103907; rev:2;)
alert tcp $HOME_NET any -> 183.151.174.249 60266 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106671; rev:2;)
alert tcp $HOME_NET any -> 183.153.114.172 58343 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103847; rev:2;)
alert tcp $HOME_NET any -> 183.158.162.161 47195 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103846; rev:2;)
alert tcp $HOME_NET any -> 185.9.139.117 58178 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103845; rev:2;)
alert tcp $HOME_NET any -> 185.216.192.119 46639 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104987; rev:2;)
alert tcp $HOME_NET any -> 190.109.228.150 37896 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101885; rev:2;)
alert tcp $HOME_NET any -> 193.163.187.75 50459 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101907; rev:2;)
alert tcp $HOME_NET any -> 193.163.187.213 45749 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103723; rev:2;)
alert tcp $HOME_NET any -> 193.187.101.209 46746 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106488; rev:2;)
alert tcp $HOME_NET any -> 196.189.3.1 35468 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104131; rev:2;)
alert tcp $HOME_NET any -> 196.189.9.27 53134 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103906; rev:2;)
alert tcp $HOME_NET any -> 196.189.35.226 36957 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106137; rev:2;)
alert tcp $HOME_NET any -> 196.189.69.192 55987 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106670; rev:2;)
alert tcp $HOME_NET any -> 196.189.98.110 47834 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106144; rev:2;)
alert tcp $HOME_NET any -> 196.190.0.118 44669 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105833; rev:2;)
alert tcp $HOME_NET any -> 196.190.0.118 48753 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106487; rev:2;)
alert tcp $HOME_NET any -> 196.191.137.44 40459 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106014; rev:2;)
alert tcp $HOME_NET any -> 196.191.233.24 47579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106229; rev:2;)
alert tcp $HOME_NET any -> 199.16.59.198 57447 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104536; rev:2;)
alert tcp $HOME_NET any -> 200.115.102.16 53743 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106094; rev:2;)
alert tcp $HOME_NET any -> 201.110.154.77 39438 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106093; rev:2;)
alert tcp $HOME_NET any -> 203.204.93.86 35425 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106669; rev:2;)
alert tcp $HOME_NET any -> 207.188.90.226 37720 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104266; rev:2;)
alert tcp $HOME_NET any -> 207.188.90.227 44244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104905; rev:2;)
alert tcp $HOME_NET any -> 210.208.104.156 37194 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105053; rev:2;)
alert tcp $HOME_NET any -> 210.208.106.68 38386 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105224; rev:2;)
alert tcp $HOME_NET any -> 210.208.106.68 47841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103768; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.4 37579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105223; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.4 43380 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103844; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.20 50244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105636; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.20 60482 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103767; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.21 35078 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105023; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.21 58400 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103766; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.42 48170 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101886; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.42 48479 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105024; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 41738 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101908; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 43845 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105594; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 55006 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106136; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.130 35632 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101909; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.130 43841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105222; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.147 49159 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101887; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.147 59877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105221; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.172 36904 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101910; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.172 46277 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106092; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.221 40213 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101911; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.221 56269 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104904; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.2 34156 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106135; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.2 48376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101912; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.26 33341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105220; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.26 49470 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101888; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.36 38915 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101889; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.36 50488 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105219; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.74 50244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105218; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.74 59088 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103843; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.100 46099 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101890; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.100 56274 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105217; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.220 37183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103765; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.220 50143 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105216; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.234 42818 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101891; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.234 49349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105593; rev:2;)
alert tcp $HOME_NET any -> 210.208.116.107 34736 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103754; rev:2;)
alert tcp $HOME_NET any -> 210.208.116.107 44471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104903; rev:2;)
alert tcp $HOME_NET any -> 216.126.86.93 35535 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106228; rev:2;)
alert tcp $HOME_NET any -> 216.126.86.154 38351 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104031; rev:2;)
alert tcp $HOME_NET any -> 218.72.34.168 44366 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104130; rev:2;)
alert tcp $HOME_NET any -> 219.157.167.99 33777 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104129; rev:2;)
alert tcp $HOME_NET any -> 220.177.11.172 54471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104030; rev:2;)
alert tcp $HOME_NET any -> 221.3.87.188 42241 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106226; rev:2;)
alert tcp $HOME_NET any -> 221.15.173.160 33401 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103764; rev:2;)
alert tcp $HOME_NET any -> 221.209.83.46 46379 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106480; rev:2;)
alert tcp $HOME_NET any -> 222.127.48.44 47607 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104265; rev:2;)
alert tcp $HOME_NET any -> 222.127.54.84 59994 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104264; rev:2;)
alert tcp $HOME_NET any -> 222.127.63.230 37978 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104528; rev:2;)
alert tcp $HOME_NET any -> 222.127.68.115 42552 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101913; rev:2;)
alert tcp $HOME_NET any -> 222.127.73.15 41760 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106664; rev:2;)
alert tcp $HOME_NET any -> 222.127.76.16 52799 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104535; rev:2;)
alert tcp $HOME_NET any -> 222.127.77.227 56118 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105213; rev:2;)
alert tcp $HOME_NET any -> 222.127.77.227 56952 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104029; rev:2;)
alert tcp $HOME_NET any -> 222.127.154.221 58286 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105212; rev:2;)
alert tcp $HOME_NET any -> 222.127.156.105 38221 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106663; rev:2;)
alert tcp $HOME_NET any -> 222.127.243.18 35695 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106662; rev:2;)
alert tcp $HOME_NET any -> 222.127.248.61 60154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106090; rev:2;)
alert tcp $HOME_NET any -> 222.139.194.242 60965 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106661; rev:2;)
alert tcp $HOME_NET any -> 222.185.164.78 52993 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105048; rev:2;)
alert tcp $HOME_NET any -> 222.185.199.120 32826 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103649; rev:2;)
alert tcp $HOME_NET any -> 222.214.101.175 41596 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106750; rev:2;)
alert tcp $HOME_NET any -> 222.246.23.18 60522 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106088; rev:2;)
alert tcp $HOME_NET any -> 222.246.41.226 44313 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103841; rev:2;)
alert tcp $HOME_NET any -> 222.246.42.116 33992 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103722; rev:2;)
alert tcp $HOME_NET any -> 223.11.56.145 52220 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104263; rev:2;)
alert tcp $HOME_NET any -> 223.14.78.86 55197 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105591; rev:2;)