minaki
Menu
Sign up / Sign in

The security a server team would run, for $1 a server a month.

Serious security is built and priced for big companies with their own security teams. If you run a VPS or a handful of Linux servers, you are mostly on your own. Minaki brings the jobs a security team does — scan for malware, check what attackers can reach, watch for break-ins, block known attackers — into one login, one bill and one plain-English report, with every change left for you to approve.

Build it yourself from the open-source tools, honestly listed on Do it yourself. Or pay $1 per server a month and we run all of it for you.

Sign up / Sign inHow it worksDo it yourself

Two places, one product. minaki.io tells you what Minaki does. suite.minaki.io is where you use it — sign up, sign in and manage your servers.

The whole suite, one agent, one bill. Minaki Scan runs on your server; the rest of the suite runs through a light agent and reports back in plain English. Sales open with the first signed release.

web-01, a test server
$ sudo minaki-scanMinaki Scan 0.8.1 on web-01 Result: 2 important problems to deal with (plus 2 other    notes). [Important] SSH accepts passwords.  Why: Bots try thousands of passwords a day against every      server on the internet. With keys only, guessing a      password gets them nowhere.    - PasswordAuthentication=yes (sshd -T)# shortened: the commands that fix it [Important] Something is set to start automatically in a way    malware typically uses.    - /etc/cron.d/netupd: @reboot root /bin/sh        /var/tmp/.sys_recovery.sh &    - /etc/systemd/system/netd.service: ExecStart=/bin/sh        /var/tmp/.sys_recovery.sh# shortened: why it matters, 2 lower-priority notes, next steps $ sudo minaki-scan --fix# shortened: the same report, then the first fix it offersApply fix for 'SSH accepts passwords.'? Type yes to apply: yes  Done. Keep this session open and test a NEW login before      closing it.  Undo: sudo rm /etc/ssh/sshd_config.d/00-minaki-scan.conf &&      sudo systemctl reload sshd Applied 1 fix. Checking again…Result: 1 important problem to deal with (plus 2 other notes).
Real output from the malware scan (Minaki Scan 0.8.1) on a test machine. Long lines are wrapped, and the parts marked "shortened" are cut for length. The startup entries are the ones left by the sample described below.

One suite, every job

Everything a small team would set up to defend a Linux server, run for you and reported together. You can do every one of these yourself with open-source tools — see Do it yourself.

Malware & server check

Looks for malware, signs of a break-in and risky settings on each server, and gives you the command that fixes each one. This is Minaki Scan, and it runs on your server.

Exposure scan: what attackers see

Looks at your server or website from the internet, the way an attacker would: open doors, exposed files, old software that shows its version. Only after you prove the server or site is yours.

Break-in watch

Watches for password guessing, a login right after many wrong passwords, new accounts and admin rights, new login keys, new programs in odd places, new things set to start on their own, and connections to known attackers.

Threat intelligence: who's knocking

Tells you whether an address reaching your server is a known attacker, from MinakiLabs' own sensors, and blocks it on your server.

File check: is this file safe?

Send us a file you were sent or found on your server, and get a plain answer: harmful, warning signs, or nothing known found. Zip and Office files are opened and checked inside. We never keep the file.

Missing updates

Finds software on each server that has a known security problem and an update waiting, and gives you the one command that installs them all.

Is this email fake?

Send us a suspicious email and get a plain answer: very likely fake, warning signs, or no signs found, plus what to do.

Email and domain check

Checks whether someone can send email pretending to be you, finds lookalike domains, and gives you the exact records to add.

The Frontier: what only we build

Open-source tools cover a lot of what a Linux server needs — we list them honestly on Do it yourself. Where they fall short, we build our own tools in-house, test each one in our lab, and add it to the suite once it passes. Our sensors keep showing us new attacks, so the work never stops.

See the Frontier

We run it on ourselves

We don't ask you to run anything we won't. MinakiLabs runs Minaki on every machine it owns — our own servers, the TunnelNet network that carries our customers' traffic, our mail, the production suite you sign in to, even the family Minecraft server. If it isn't good enough for our machines, it isn't good enough for yours.

7of the servers we run have the Minaki agent installed. That number comes from the suite, not typed in by hand.

Read the field notes

What our sensors saw in the last 24 hours

Counted from the logs of our 7 honeypot sensors in Asia, Europe and North America, for the 24 hours to 15 Oct 2026, 16:00 UTC. Updated every hour. See the captures

  • 38,722times attackers connected to our sensors
  • 1,476different addresses they came from
  • 891,745commands they typed once inside
  • 23files attackers left behind, caught since 14 Oct
  • 118Linux threats documented, 18 with full pages

From a live attack to a tested cure

Every cure in Minaki Scan starts as a real attack or a published one, and none ships until it has been tested on an isolated machine.

  1. We catch real attacks

    Our honeypot sensors pose as ordinary servers. They record what attackers do and keep the files they leave behind.

  2. We identify it and write a cure

    AI helps us identify each threat from its files and from published security research, and draft a removal procedure. A person decides whether each cure ships.

  3. We prove the cure first

    Each cure is tested on an isolated machine with no network: put the threat there, remove it, scan again. It ships only when the scan comes back clean.

  4. You run Minaki Scan

    The scan reports first and changes nothing. Add --fix and it offers each fix one at a time, and applies it only when you type yes.

Cure tested on this real sample

Mirai-lineage DDoS bot

SHA-256 3674a103804cac96027fe1cf62aaab4948c1d547d1c885542177a263103b4260
Caught
14 Oct 2026, 13:16 UTC
Where
Our sensor in US West (San Jose)
File
Linux program, 64-bit x86
Left behind
  • a hidden copy of itself in /var/tmp
  • a relaunch script, /var/tmp/.sys_recovery.sh
  • a boot-time scheduled task, /etc/cron.d/netupd
  • a system service, netd.service
  • a startup script, /etc/init.d/sys_daemon
Shipped in
Minaki Scan 0.8.0

One capture, start to finish

A sensor recorded the attack and kept the program the attacker left. We ran that program on an isolated test machine and watched what it changed. It sets up three separate ways to restart itself, so removing just one leaves it running.

The cure removes all three, stops every bot process, deletes the files and scans again: clean. We then set off every startup method the sample had installed, the way a restart would. Nothing came back and no bot process was left.

We call it Mirai-lineage rather than Mirai. It shares markers with Mirai and with a related family, Gafgyt, and nothing in it is unique to either.

Our first cure missed two of the three restart methods. We found them by looking harder at the sample before the cure shipped. That's why every cure is tested before it reaches you.

Read the Mirai page in the threat wiki, or see how we test every cure.

What it catches today

The Linux threats it can remove, and the ones it won't pretend to. Their pages in the threat wiki list the signs to look for and the steps to remove each one by hand.

Removes, with your OK

Found by the fingerprints of their files and processes. Removed only after you type yes.

Detects, and tells you to rebuild

These hide inside the system itself, below the level any scanner can trust. Minaki Scan tells you what it found and advises backing up your data and reinstalling. It doesn't try to clean them.

Also checks every server for

  • SSH that accepts passwords
  • root logging in with a password
  • SSH keys you might not recognize
  • extra accounts with full control
  • risky sudo rules
  • programs forced into every process
  • suspicious startup entries
  • programs running from temp folders
  • unexpected open ports
  • password-guessing attempts
  • known malware files
  • pending updates and reboots

Why you can let it run as root

A tool you run with full control over your server has to earn it. Here is what Minaki Scan does and doesn't do. The full list is here.

Every finding shows its evidence

Each finding names the exact file, line or setting it found, why it matters, and the command that fixes it. Nothing is a mystery score.

You approve every change

Copy the commands and fix it by hand, or let Minaki Scan apply them one at a time after you type yes. It backs up what it changes and logs every change on your server.

Nothing leaves your server

The scan runs on your machine and makes no network connections. The report stays with you.

It says what it can't do

No scanner can prove a server clean. Minaki Scan tells you what it checked, what it couldn't check, and when the honest answer is to rebuild.

$1per server, per month

  • Billed once a year ($12 per server) to keep card fees low, with no minimums
  • Every job in the suite, on each server you pay for
  • New checks and cures as we build and test them, delivered as updates
  • The malware & server check runs on your server and never contacts us; the rest sends only findings, never your files or data

Sales open with the first signed release. How pricing and licenses work

Questions before you install

Will it change anything without asking?

No. A normal scan only reads. Fixes are offered only when you run it with --fix, one at a time, and each one runs only after you type yes.

Can I undo a fix?

Yes, for settings. When Minaki Scan changes a setting, such as switching off SSH passwords, it prints the exact command that undoes it and records it under /var/lib/minaki-scan/. Malware it removes is kept as a copy that can't run, in a folder only root can open. A stopped malware process can't be restarted, and you wouldn't want it to be.

Does my data leave my server?

The malware & server check runs entirely on your server and makes no network connections, so nothing about your server leaves it. The rest of the suite runs through a light agent that sends us only findings and summaries -- a failed-login count, a file's fingerprint, a note of what changed -- so the heavy analysis runs on our side and we send back a plain-English report. What it sends travels encrypted over HTTPS, we keep it for 30 days and then delete it, and we never sell it. The agent never sends your files, their contents, your data, your passwords or your keys. How it works lists exactly what does and doesn't leave your server.

If it finds nothing, is my server clean?

Not necessarily. It means none of its checks found a problem. The report says how many checks it couldn't run, for example because it wasn't run as root, and minaki-scan --advanced lists them. No scanner can prove a machine clean.

What about rootkits?

Minaki Scan looks for signs of the rootkit families listed above. If it finds one, it tells you to back up your data and reinstall rather than trying to clean it, because a system in that state can't be trusted to report on itself.

Why does it need root?

To read the places attackers hide things: every user's scheduled tasks, system services, the SSH settings and every running program. Without root it still runs, and the report tells you how many checks it had to skip.

How do updates work?

Packages and detection updates will be signed with the MinakiLabs release key, and your server checks that signature before installing anything. Signed releases are being set up now.

What does it cost?

$1 per server a month, billed once a year at $12 per server, with no minimums. Sales open with the first signed release.

Is it open source?

No. The core of the scanner isn't open source.

When one server is attacked, everyone's defenses learn

Our honeypot sensors already catch live attacks on Linux servers every day — the numbers above are real, not an estimate. As the suite grows, customers will be able to opt in to share only the signals of an attack: the attacker's address, the pattern, a malware fingerprint. Never your files, your data, your credentials or anything that identifies you. It will be off by default and explained in full before you ever turn it on. We sell security, not your data. How shared defense works.

More from MinakiLabs

Minaki secures your servers. TunnelNet, also from MinakiLabs, protects your network and gives your machines their own address on the internet.

TunnelNet HaloNetwork security for a small business: blocks malware and trackers on every device and filters harmful sites. TunnelNet IPA public IPv4 address for any machine you own. TunnelNet VPNYour own server in the city you choose, with an IP that is yours and ad and tracker blocking. TunnelNet MonitoringWebsite and server checks run from outside our own network. TunnelNet MailSend email from your own domain, signed so it arrives.