alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Ethereum Contract Request, getDomain()"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"application/json"; http.request_body; content:"|22|eth_call|22|"; content:"|22|0xb68d1809|22|"; fast_pattern; reference:url,levelblue.com/blogs/spiderlabs-blog/err-hiding-and-seek-how-errtraffic-v3-leverages-etherhiding-in-clickfix-campaign; reference:url,4byte.directory; classtype:misc-activity; sid:2070070; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_25, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_06_25;)