SilverFox api.php relay dispatcher request with ms-timestamp query

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•3

Detects HTTP requests directed at the 'noah-ssh.com.cn' domain targeting '/api.php' with a specific 13-digit millisecond timestamp pattern. This behavior is indicative of a relay or dispatcher mechanism associated with SilverFox SEO poisoning campaigns, used to manage or redirect traffic.