SilverFox api.php Relay Dispatcher Request to noah-ssh.com.cn

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•3

This rule detects suspicious outbound HTTP GET requests to a known domain (noah-ssh.com.cn) targeted by the SilverFox malware relay dispatcher. It specifically monitors for requests to '/api.php' containing a 13-digit numeric timestamp parameter, which is a characteristic pattern of its C2 communication.