Linux malware scanner and server intrusion alerts
If someone got into your server, would you know? We're building a bot that will run regular security checks on your Linux servers and tell you, in plain words, when something changes that should not have.
Built for
- People running a VPS or home server
- Small teams without a security person
- Developers hosting a few sites or apps
- Anyone who installed a server once and hopes it is fine
Why this bot
Most break-ins on small servers are quiet. A password gets guessed, a miner gets installed, a system file gets swapped, and nobody notices until the bill goes up or the site gets flagged.
Good open-source security tools exist, but they need setup, produce long reports, and are easy to stop reading. The useful part is knowing what changed and whether it matters.
Three steps
Install a small agent
You will add a lightweight program to each server. It is planned to run with clear, limited permissions you can review.
It runs regular checks
It will look for malware signatures, rootkit signs, changes to important system files, bursts of failed logins, and ports that newly opened to the internet.
You get a plain alert
When something looks wrong, you will get a text, email or Discord message saying what changed, why it may matter, and what to check first.
What it will and will not do
It will detect and report. It is not planned to delete files or change your firewall on its own, since a wrong automatic fix can take a server down. You stay in control of every action.
Limits
No scanner catches everything. A careful attacker can hide from checks, and new malware may not match any known signature. Think of this as an early warning layer, not a promise of safety. It is planned for Linux only at first.
Still deciding
Which distributions we test first, how often each check runs, and how to keep alerts few enough that you still read them.
Get early access to the Server Guard Bot
Leave your email and we'll put you on the list for this bot.
We'll email you when early access opens for this bot. One email per bot, no spam, and you can ask us to delete your address at any time.
Questions people ask
How do I scan a Linux server for malware?
Common free tools include ClamAV for malware signatures and rkhunter or chkrootkit for rootkit checks. Run them regularly, update their signatures, and actually read the results. This bot is being built to run checks like these on a schedule and summarize them for you.
How can I tell if my Linux server has been hacked?
Warning signs include unknown processes using lots of CPU, new user accounts, changed system binaries, unexpected open ports, and many failed or odd logins. Comparing against a known good baseline makes changes easier to spot.
What is a rootkit?
A rootkit is malware built to hide itself, often by replacing system tools so they lie about what is running. Checking file fingerprints against a trusted baseline is one way to catch it.
What is server intrusion detection?
Intrusion detection means watching a system for signs of an attack or break-in, such as file changes, login patterns and new network activity, and raising an alert. It tells you something happened; it does not stop it by itself.
Is it available now?
Not yet. It is in planning. Join early access to hear when it is ready for testing.