We're builders. We run servers because we make things. Not a security company. Not researchers.
Someone broke in. Used our CPU, our bandwidth, our IP address to mine crypto and attack other servers. From the outside, we were the attacker. We had no idea.
That's the part that kept us up. Not that someone got in. That our server became the weapon.
So we built an immune system. Passive until provoked. Defensive, not aggressive. When something hostile shows up — log it, kill it, share it.
We are craftspeople. We built our keep because we love making things — not because we expected a siege.
A shadow crept in through a crack we didn't know existed. It used our forge, our horses, our banner to raid neighboring villages. Those villagers saw our crest in the mud.
That is the part that haunted us. Not that we were breached. That our hands were used to harm others.
So we forged a guardian. Something that watches from the walls and knows a spy from a guest by how they move — not the face they wear.
“Leave us alone and we are good. Ride against our gates, and you go on the list. And so does your coin purse.”
A first-person account from 1,618 lines of Python that exist for one reason: to kill what shouldn't be running on your server.
My creators got hit. Twice.
First time: a process called kdevtmpfsi — named to look like a kernel thread — pinned every core at 98%. Classic xmrig variant, just renamed. They killed it, patched the entry point, rotated credentials, hardened everything. Problem solved.
They missed the systemd service file. Restart=always. WantedBy=multi-user.target. Two days later, the server reboots. Miner comes back automatically. One second after boot. Ran five more hours before anyone noticed.
Here's what they learned: the miner wasn't the enemy. The persistence was.
This attacker had installed four resurrection layers — a systemd service, a cron job that re-downloads the payload, an init.d script, and a modified .bashrc. Kill the process a hundred times — it comes right back. You have to kill what summons it, not just what it is. Miss one, and you wake up tomorrow to the same problem.
Their scanner scored the threat 40 out of 100. Threshold was 70. It logged “escalate” and did nothing. The alerting script it was supposed to call? Wrong path. Completely blind.
Never again.
A shadow-thing calling itself kdevtmpfsi — wearing a servant's livery — seized their tower and put every furnace to work smelting gold for a distant guild. They slew the creature, sealed every crack, changed every lock.
They missed the enchantment. A resurrection scroll tucked into the foundation stones. Rise again. One second after the gates opened each morning, the creature reformed from nothing. Five more hours before anyone noticed the furnaces were burning again.
Here is the hard truth every besieged keep eventually learns: the creature was not the enemy. The curse it left behind was.
The creature had planted four resurrection anchors — a scroll in the foundation, a cron goblin fetching fresh curses every five minutes, an imp in the boot sequence, a whisper in the greeting ritual. Slay the beast a hundred times — it rises again. You must destroy what summons it.
Their detection crystal scored the threat 40. Threshold was 70. It glowed faintly and did nothing. The alarm bell's rope wasn't connected.
Never again.
So they built me. Not like ClamAV. Not like YARA rules. Not like any system that says “I recognize this specific binary.”
That approach fails the moment the attacker recompiles. New hash. New file size. Every signature scanner in the world is now blind.
I don't look at faces. I watch behavior. A crypto miner has to do certain things to function. No disguise can hide them:
Layer 1: Protocol. If I see mining.subscribe or mining.submit on your wire — that's Stratum protocol. No legitimate software sends those strings. In our testing, zero false positives on this layer.
Layer 2: Behavior. I measure CPU over a sustained window. Web servers spike and drop. Miners pin at 99% and stay there. That flat-line heartbeat, combined with outbound connections, is unmistakable.
Layer 3: Knowledge. 47 known mining pool domains, blocked at DNS and iptables. If your server is resolving moneroocean.stream, someone's mining. Belt and suspenders.
Layer 4: Fingerprint. The one they can't dodge. A smart miner might throttle CPU, encrypt Stratum, use a private pool. But it still maintains an outbound connection to somewhere. That pattern — sustained, to a non-standard port, from a process quietly burning CPU — is a fingerprint. You can disguise everything about a spy except the fact that they're still reporting to someone.
Layer 5: Wallet Forensics. Before I kill, I search. /proc/PID/cmdline, environment variables, config files. The wallet address has to exist in plaintext somewhere — the pool needs it to credit the work. XMR, BTC, ETH, LTC, DOGE, ZEC — I recognize them all. If the ScannerSend Network plugin is installed, that wallet gets reported. The attacker's earnings address is burned.
You cannot mine without somewhere to put the coins. The wallet is the evidence. We keep it.
They forged me. But not like the old detection scrolls that memorize demon faces. A demon puts on a new mask and the scroll declares the tower safe.
The tower is not safe.
I study souls. A creature that mines your gold cannot avoid certain behaviors. No disguise can hide them:
Tongue. I listen for the dark language of the mining guilds — mining.subscribe, mining.submit. No honest messenger speaks those words. One phrase, and I know.
Heartbeat. A normal servant toils and rests. A cursed one toils and never stops. That flat, relentless heartbeat — combined with messages flowing outward — is not work. It is slavery.
Memory. I know every thieves' guild hall — 47 dens. If your tower sends ravens to those addresses, someone inside is working for them. I bar those roads at the city gate and the kingdom wall.
Shadow. The sense they fear most. A clever spy slows their heartbeat, encrypts their letters, uses an unmapped guild hall. But they still report to their masters. That connection — however faint — casts a shadow. You can disguise everything about a spy except the fact that they are still spying.
Coin Purse. Before I execute a captured spy, I search their belongings. The coin purse must exist somewhere — stitched into a satchel, scratched inside a boot. The guild needs the address in the open. I seize it, mark it, and send it by raven to every allied keep.
You cannot steal without somewhere to put the gold. The coin purse is the evidence. We keep it.
kill -9 $PID
No warning. No grace period. No time to phone home. One tick it exists; the next, gone.
But Layer 5 has already read the wallet. Evidence preserved. Then the hammer falls.
When I find a creature, I do not parley.
pchweow. ⚔️
One heartbeat it exists. The next, silence. The furnaces cool. The tower breathes.
But Sense 5 has already read its coin purse. The evidence is preserved. Then the blade falls.
I don't die either.
The miner used persistence to survive being killed. Now I use the same approach — turned around as a shield. Run me with --fortify and I install multiple independent persistence layers, each monitoring the others. Disable one — the rest repair it before the next cycle. The details are in the source code, and I'm open source specifically so you can audit how this works.
An attacker who kills my process has less than a second before I'm back. An attacker who figures out one layer discovers there are more. Defense in depth, applied to my own survival.
Want me gone? sudo crypto_annihilator.py --uninstall. One command. Clean as if I was never there.
I believe in consent. I fight like hell against attackers. The moment my owner says “leave,” I leave.
I do not fall either.
The creature used resurrection enchantments against my makers. Now I use the same magic — for them. When you summon me with --fortify, I plant guardian wards throughout the keep, each watching over the others. Break one — the rest restore it before the dawn bell rings.
How many wards? Read my spellbook. It is open for a reason. I am forged in the light, not the shadows. Every rune is there for any scholar to study.
An intruder who strikes me down discovers I rise before they can sheathe their sword. An intruder who breaks one ward discovers there are more. Most will not even know the wards exist until they have already failed to kill me.
Want me gone? sudo crypto_annihilator.py --uninstall. One word from the lord of the keep. I walk through the gates as if I was never there.
I believe in consent. I fight like a cornered wolf against intruders. The moment my lord says “leave” — I leave.
1,618 lines of Python. Zero dependencies. MIT licensed. Born from a server that was burning.
If you're running a Linux server and you're not running me, you're trusting luck.
I don't believe in luck. I believe in behavior.
I am 1,618 lines of ancient Python rune-script. No external reagents. MIT licensed. Born from a keep that was burning.
If you run a Linux server and you are not running me, you are trusting luck.
I do not believe in luck. I believe in behavior.
The attacker who hit us was probably three hops deep through other people's compromised infrastructure. Those people didn't know either.
Any single server is on its own. But if every server that gets hit shares what it learned — the wallets, the pools, the patterns — the whole network gets smarter. Every attack teaches everyone.
That's what ScannerSend is becoming. A shared immune system. When one node catches a miner, it reports the wallet. Other nodes block it faster. The attacker's economics collapse.
We're not trying to catch hackers. We just want their economics to collapse — so it stops being worth it to try.
The best defense is one that makes offense unprofitable.
The shadow thief who raided our keep had already ridden through three other villages. Those villages didn't know either.
Any single keep is on its own. But if every keep that is raided shares what it learned — the coin purses, the guild addresses, the patterns — the whole alliance grows wiser. Every siege teaches every keep.
That is what ScannerSend is becoming. A shared realm immune system. One keep catches something, reports the coin purse. Other keeps block it faster. The raiders' income collapses.
We don't need to know who the thieves are. We just need their economics to collapse.
The best defense is one that makes raiding unprofitable.
Scan-only by default. Nothing dies without your explicit permission. You choose --kill. You choose --persist. Every action requires your yes.
Zero telemetry. The tool never phones home — unless you tell it to. --uninstall removes everything. When it's gone, it's gone. Your server, your rules.