Server hacked? We help you stop it.
We stop the attack, remove what the attacker left and close the way they got in. Then we explain in plain language how it happened. Message us and we tell you when we can start.
Ubuntu and Debian, at any provider · WordPress, PHP, Node.js, Python, Docker · Supervised by an operator, with a backup first
While you wait: what to do right now
- Don't delete anything and don't reinstall yet.The traces of how they got in are still on the server, and we need them to close the way in. Reinstall without closing it and they can get into the new server too.
- Take a snapshot, if your provider allows it.It keeps the server exactly as it is now, evidence included.
- Don't shut it down or restart it if you can avoid it.What the attacker has running can only be seen while the server is on. If your provider asks you to stop it, do as they say.
- Change your provider's control panel password from another device.With that password an attacker could delete the server or its backups. Use your computer or phone, not the server.
Then message us with your provider and what you have noticed.
Signs that someone else is using your server.
If you notice one or more of these, message us with what you have seen.
We stop the attack and close the way in.
Our AI reads the whole server and correlates what it finds, and a second AI model checks its findings. During diagnosis the AI only reads; changes follow a plan you accept, are made after a backup and the process is supervised by our operators.
- We stop the attackWe stop what the attacker has running: miners, spam, connections to their servers.
- We remove what the attacker leftBackdoors, users, keys and scheduled tasks left behind to get back in.
- We close the way they got inWe fix what they used, for example a vulnerable plugin, an outdated version or a stolen password.
- Plain-language reportHow they got in, what they touched and what we changed.
- You stay in controlFollow your order step by step, and stop our work with one click.
- A backup before every changeBefore we touch anything, we save a copy.
What it costs and how we start.
Priced per server.
Emergency clean-up
Slow server, unknown processes, spam pages or a warning from your host.
€690 one server
Need it sooner? Message us: we tell you when we can start, and we confirm we can take it before you pay.
- We stop the attack and remove what the attacker left: miners, backdoors, rogue users, keys and scheduled tasks
- We close the way they got in
- Plain-language report: how they got in, what they touched and what we changed
- Follow your order step by step, and stop our work with one click
- A backup before every change
How we start
- You message usOn WhatsApp or with the form: your provider and what you have noticed.
- We confirm before you payWe tell you when we can start and confirm we can take it.
- You give us temporary accessSSH access created only for you. When we finish we delete our key and you remove the access with a single command. We explain each step.
- We clean up and send the reportHow they got in, what they touched and what we changed.
Prices in euros, taxes not included. For businesses and professionals only.
All prices are billed in euros; dollar amounts are approximate.
Emergency questions.
How much does it cost?
€690 per server, taxes not included. That includes the clean-up and the report. We confirm we can take it before you pay. For businesses and professionals only.
When can you start?
It depends on our workload at that moment. Message us on WhatsApp or use the form: we tell you when we can start, and we confirm we can take it before you pay.
Should I reinstall the server?
Not yet. Reinstalling wipes the traces of how they got in, and if that way in is still open they can get into the new server too. First we find out how they got in and close it.
What access do you need?
Temporary SSH access, created only for you: when we finish we delete our key and you remove the access with a single command. We explain step by step how to set it up. We never ask for a root password.
Do you work with shared hosting?
We work on servers you control: a VPS, a dedicated server or a cloud server, at any provider. On shared hosting we cannot get the access we need. Order the exposure report (€9.99) and we will tell you what we can see from outside.
Which systems do you support?
Ubuntu and Debian servers at any provider (Hetzner, OVH, DigitalOcean, AWS, Contabo and others) running WordPress, PHP, Node.js, Python or Docker. Other Linux distributions on request.
Can it happen again?
We close the way they got in. For continuous protection, Watch opens soon: you can join the waiting list on our home page.
Tell us what happened.
Tell us your provider and what you have noticed. WhatsApp is the quickest way to reach us.