# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 24 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: payload b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605 — https://publicmosaic.com/payload/b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 1
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 27.219.50.172 60907 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106545; rev:2;)
alert tcp $HOME_NET any -> 39.86.115.129 43919 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105444; rev:2;)
alert tcp $HOME_NET any -> 42.227.237.197 49632 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105348; rev:2;)
alert tcp $HOME_NET any -> 42.234.232.151 35677 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106537; rev:2;)
alert tcp $HOME_NET any -> 42.239.189.113 49093 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106117; rev:2;)
alert tcp $HOME_NET any -> 46.236.65.23 41753 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105354; rev:2;)
alert tcp $HOME_NET any -> 61.53.83.19 36154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105353; rev:2;)
alert tcp $HOME_NET any -> 61.53.236.32 49022 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106140; rev:2;)
alert tcp $HOME_NET any -> 112.248.108.140 41002 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105429; rev:2;)
alert tcp $HOME_NET any -> 112.254.223.118 43542 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105350; rev:2;)
alert tcp $HOME_NET any -> 115.49.7.34 40290 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105349; rev:2;)
alert tcp $HOME_NET any -> 115.49.73.224 59218 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105435; rev:2;)
alert tcp $HOME_NET any -> 115.53.209.141 35634 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106520; rev:2;)
alert tcp $HOME_NET any -> 115.55.54.214 42911 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105351; rev:2;)
alert tcp $HOME_NET any -> 115.55.194.73 43155 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105352; rev:2;)
alert tcp $HOME_NET any -> 115.57.207.68 49426 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106759; rev:2;)
alert tcp $HOME_NET any -> 115.60.252.50 38555 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105838; rev:2;)
alert tcp $HOME_NET any -> 115.62.146.115 39533 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105641; rev:2;)
alert tcp $HOME_NET any -> 125.41.183.143 34893 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106215; rev:2;)
alert tcp $HOME_NET any -> 125.41.228.123 58883 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106754; rev:2;)
alert tcp $HOME_NET any -> 125.44.214.233 54441 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106147; rev:2;)
alert tcp $HOME_NET any -> 182.112.28.50 36154 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106234; rev:2;)
alert tcp $HOME_NET any -> 182.126.84.63 48055 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106547; rev:2;)
alert tcp $HOME_NET any -> 222.137.235.158 37181 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105592; rev:2;)