minaki scan
Menu

Know if your Linux server has been hacked, and clean it up safely.

Minaki Scan checks your server for the malware attackers are using right now, explains every finding in plain English, and gives you the exact command that fixes it. When it can prove malware is there, it removes it, but only after you type yes.

sudo minaki-scan

$1 per server a month. Downloads open soon, as signed packages for Debian and Ubuntu and a signed download for other Linux.

How to install itWhat it catches
web-01, a test server
$ sudo minaki-scanMinaki Scan 0.8.0 on web-01 Result: 2 serious problems to deal with (plus 2 other notes). [Important] SSH accepts passwords.  Why: Bots try thousands of passwords a day against every      server on the internet. With keys only, guessing a      password gets them nowhere.    - PasswordAuthentication=yes (sshd -T)# shortened: the commands that fix it [Important] Something is set to start automatically in a way    malware typically uses.    - /etc/cron.d/netupd: @reboot root /bin/sh        /var/tmp/.sys_recovery.sh &    - /etc/systemd/system/netd.service: ExecStart=/bin/sh        /var/tmp/.sys_recovery.sh# shortened: why it matters, 2 lower-priority notes, next steps $ sudo minaki-scan --fix# shortened: the same report, then the first fix it offersApply fix for 'SSH accepts passwords.'? Type yes to apply: yes  Done. Keep this session open and test a NEW login before      closing it.  Undo: sudo rm /etc/ssh/sshd_config.d/00-minaki-scan.conf &&      sudo systemctl reload sshd Applied 1 fix. Checking again…Result: 1 serious problem to deal with (plus 2 other notes).
Real output from Minaki Scan 0.8.0 on a test machine. Long lines are wrapped, and the parts marked "shortened" are cut for length. The startup entries are the ones left by the sample described below.

What our sensors saw in the last 24 hours

Counted from the logs of our 7 honeypot sensors in Asia, Europe and North America, for the 24 hours to 15 Oct 2026, 16:00 UTC. Updated every hour. See the captures

  • 38,722times attackers connected to our sensors
  • 1,476different addresses they came from
  • 891,745commands they typed once inside
  • 23files attackers left behind, caught since 14 Oct
  • 118Linux threats documented, 18 with full pages

From a live attack to a tested cure

Every cure in Minaki Scan starts as a real attack or a published one, and none ships until it has been tested on an isolated machine.

  1. We catch real attacks

    Our honeypot sensors pose as ordinary servers. They record what attackers do and keep the files they leave behind.

  2. We identify it and write a cure

    AI helps us identify each threat from its files and from published security research, and draft a removal procedure. A person decides whether each cure ships.

  3. We prove the cure first

    Each cure is tested on an isolated machine with no network: put the threat there, remove it, scan again. It ships only when the scan comes back clean.

  4. You run Minaki Scan

    The scan reports first and changes nothing. Add --fix and it offers each fix one at a time, and applies it only when you type yes.

Cure tested on this real sample

Mirai-lineage DDoS bot

SHA-256 3674a103804cac96027fe1cf62aaab4948c1d547d1c885542177a263103b4260
Caught
14 Oct 2026, 13:16 UTC
Where
Our sensor in US West (San Jose)
File
Linux program, 64-bit x86
Left behind
  • a hidden copy of itself in /var/tmp
  • a relaunch script, /var/tmp/.sys_recovery.sh
  • a boot-time scheduled task, /etc/cron.d/netupd
  • a system service, netd.service
  • a startup script, /etc/init.d/sys_daemon
Shipped in
Minaki Scan 0.8.0

One capture, start to finish

A sensor recorded the attack and kept the program the attacker left. We ran that program on an isolated test machine and watched what it changed. It sets up three separate ways to restart itself, so removing just one leaves it running.

The cure removes all three, stops every bot process, deletes the files and scans again: clean. We then set off every startup method the sample had installed, the way a restart would. Nothing came back and no bot process was left.

We call it Mirai-lineage rather than Mirai. It shares markers with Mirai and with a related family, Gafgyt, and nothing in it is unique to either.

Our first cure missed two of the three restart methods. We found them by looking harder at the sample before the cure shipped. That's why every cure is tested before it reaches you.

Read the Mirai page in the threat wiki, or see how we test every cure.

What it catches today

The Linux threats it can remove, and the ones it won't pretend to. Their pages in the threat wiki list the signs to look for and the steps to remove each one by hand.

Removes, with your OK

Found by the fingerprints of their files and processes. Removed only after you type yes.

Detects, and tells you to rebuild

These hide inside the system itself, below the level any scanner can trust. Minaki Scan tells you what it found and advises backing up your data and reinstalling. It doesn't try to clean them.

Also checks every server for

  • SSH that accepts passwords
  • root logging in with a password
  • SSH keys you might not recognize
  • extra accounts with full control
  • risky sudo rules
  • programs forced into every process
  • suspicious startup entries
  • programs running from temp folders
  • unexpected open ports
  • password-guessing attempts
  • known malware files
  • pending updates and reboots

Why you can let it run as root

A tool you run with full control over your server has to earn it. Here is what Minaki Scan does and doesn't do. The full list is here.

Every finding shows its evidence

Each finding names the exact file, line or setting it found, why it matters, and the command that fixes it. Nothing is a mystery score.

You approve every change

Copy the commands and fix it by hand, or let Minaki Scan apply them one at a time after you type yes. It backs up what it changes and logs every change on your server.

Nothing leaves your server

The scan runs on your machine and makes no network connections. The report stays with you.

It says what it can't do

No scanner can prove a server clean. Minaki Scan tells you what it checked, what it couldn't check, and when the honest answer is to rebuild.

$1per server, per month

  • Every check and every tested cure in Minaki Scan, on each server you pay for
  • New cures as we build and test them, delivered as signed updates
  • Your server never contacts us: the scan and its report stay on it

Sales open with the first signed release. How pricing and licenses work

Questions before you install

Will it change anything without asking?

No. A normal scan only reads. Fixes are offered only when you run it with --fix, one at a time, and each one runs only after you type yes.

Can I undo a fix?

Yes, for settings. When Minaki Scan changes a setting, such as switching off SSH passwords, it prints the exact command that undoes it and records it under /var/lib/minaki-scan/. Malware it removes is kept as a copy that can't run, in a folder only root can open. A stopped malware process can't be restarted, and you wouldn't want it to be.

Does it send my data anywhere?

No. The scan runs entirely on your server and makes no network connections. The report stays with you.

If it finds nothing, is my server clean?

Not necessarily. It means none of its checks found a problem. The report says how many checks it couldn't run, for example because it wasn't run as root, and minaki-scan --advanced lists them. No scanner can prove a machine clean.

What about rootkits?

Minaki Scan looks for signs of the rootkit families listed above. If it finds one, it tells you to back up your data and reinstall rather than trying to clean it, because a system in that state can't be trusted to report on itself.

Why does it need root?

To read the places attackers hide things: every user's scheduled tasks, system services, the SSH settings and every running program. Without root it still runs, and the report tells you how many checks it had to skip.

How do updates work?

Packages and detection updates will be signed with the MinakiLabs release key, and your server checks that signature before installing anything. Signed releases are being set up now.

What does it cost?

$1 per server a month. Sales open with the first signed release.

Is it open source?

No. The core of the scanner isn't open source.

More from MinakiLabs

Minaki Scan checks your servers. TunnelNet, also from MinakiLabs, protects your network and gives your machines their own address on the internet.

TunnelNet HaloNetwork security for a small business: blocks malware and trackers on every device and filters harmful sites. TunnelNet IPA public IPv4 address for any machine you own. TunnelNet VPNYour own server in the city you choose, with an IP that is yours and ad and tracker blocking. TunnelNet MonitoringWebsite and server checks run from outside our own network. TunnelNet MailSend email from your own domain, signed so it arrives.