alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Ethereum Contract Request, getURL()"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"application/json"; http.content_len; byte_test:0,<=,500,0,string,dec; http.request_body; content:"|22|eth_call|22|"; content:"|22|0x38bcdc1c|22|"; fast_pattern; reference:url,levelblue.com/blogs/spiderlabs-blog/err-hiding-and-seek-how-errtraffic-v3-leverages-etherhiding-in-clickfix-campaign; reference:url,4byte.directory; classtype:misc-activity; sid:2070035; rev:2; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_23, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_06_25;)