SilverFox api.php relay dispatch request with timestamp parameter

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•3

Detects communication between a host and a suspected malicious domain (noah-ssh.com.cn) characterized by a specific API request containing a millisecond timestamp and a subsequent HTTP response containing a 'download_link' field. This pattern is indicative of the SilverFox malware relay mechanism, likely used for staging and downloading additional malicious payloads.