Netch-gateway Shadowsocks auto-config request to sheng886.top

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•0

Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.