Malware Scanning for Hosting Providers

The problem

Why it’s harder than it looks.

Abuse reports and IP reputation

One compromised account sending spam or hosting phishing can get a shared IP range listed, affecting every customer on it.

Customers cannot clean their own sites

Most tenants do not have the skills to remove a webshell or find a cron re-infection, so tickets escalate to your support team.

Infections cross account boundaries

Weak isolation lets one tenant's infection spread, and a single root-level backdoor puts the whole server at risk.

What you get

Built for how you actually work.

Server-side scanning across tenants

The Malware sweep and Forensic scan run across every account on the server, not one site at a time.

Isolate infected accounts

Contain a compromised account quickly, quarantining malicious files with evidence kept, while other tenants stay online.

Abuse report handling

We investigate abuse complaints, find the script or account responsible and provide a written summary you can send back.

Root-level persistence checks

Crontabs, systemd units, SSH keys, ld.so.preload and tunnel agents checked for backdoors that survive account clean-ups.

Hardening playbooks

PHP-FPM pool isolation, permissions and upload execution rules applied consistently across tenants.

Reports and audit trail

Findings, timelines and hashes for every incident, plus an Activity log of every action taken on your servers.

Reporting

Reports your clients, insurers and auditors can read.

Plain-English executive summaries up front, full technical findings, timelines and hashed evidence behind them. HTML report plus ZIP package.

INCIDENT REPORT · PZ-2026-0192

acme-prod-01 · Remediation summary

Risk beforeCritical

Risk afterLow

Files quarantined2,047

Evidence hashesSHA-256

Executive summary

The server was compromised through a vulnerable upload endpoint. The attacker installed a webshell, a rogue administrator and a cron job that re-downloaded the payload every minute. All persistence has been removed and the entry point closed.

report.html evidence.zip

How does server malware detection work for hosts?

PatientZero connects to each server over SSH, deploys a scan engine to /opt/patient-zero/scan-engine and scans every tenant's files and the server's own persistence points. Findings are grouped by account and site, so your team sees at once which customer is infected and whether the server itself is compromised.

Account-level scanners only see inside each account. Attackers who reach root or escape an account leave traces elsewhere: a systemd unit, a key in /root/.ssh/authorized_keys, a reverse shell listening on a high port. The Forensic scan checks these alongside the tenant files covered by the Malware sweep.

How do you isolate an infected hosting account?

We contain the affected account first, then clean it. That means quarantining active webshells and spam scripts, removing the attacker's scheduled tasks and keys, and stopping outbound abuse, so other customers are protected while the investigation continues. The aim is to fix one account without taking the whole server down.

Identify. Match the abuse report or finding to the account, script and process responsible.
Contain. Quarantine malicious files with hashes kept, kill malicious processes and remove persistence.
Clean. Remove injected code, rogue admins and backdoors across the account's sites.
Harden. Apply pool isolation and upload rules so the same route cannot be reused.
Report. Provide a summary for your abuse desk and a report for the customer.

Tip: suspend outbound mail for the affected account while it is investigated. It protects your IP reputation and does not affect other tenants.

How is PatientZero priced for hosting providers?

Hosting providers are covered by the Server / Multi-site plan, priced on application because every estate is different. We scope it around the number of servers, the number of tenant accounts and how you want incidents handled. Every plan includes unlimited malware removal, 24/7 monitoring and hardening, with no long-term contract.

Fair use applies to full server rebuilds. To discuss your estate, contact our team or read about server malware removal.

Pricing

Plans that fit.

Every plan includes unlimited malware removal and no long-term contract.

Server / Multi-site

Your whole VPS or shared server, every site on it included.

POA

Scoped to your server

Scope my server

Whole VPS or shared server
All sites included
Unlimited clean-ups
Full-server monitoring and hardening
Firewall and SSH lockdown
Priority response

Agency (white-label)

Whole-server protection for your client sites, under your brand.

From£299/month

White-label for your clients

Talk to us

Whole-server protection for client sites
Fully white-label
Shareable client reports
Updates across client sites
Priority emergency response

Every plan includes unlimited malware removal and no long-term contract. New accounts start with a one-off £129.99 security audit so we know exactly what we’re cleaning before the first removal.

No contract
Cancel any time
Rapid response
Fair use applies to full rebuilds

FAQs

Frequently asked questions

Straight answers. If yours isn’t here, call 01932 593642.

Do you work with cPanel and CloudPanel servers?

Yes. PatientZero works on Linux servers reachable over SSH, including cPanel, CloudPanel and plain VPS setups on providers such as AWS. The scan engine discovers the WordPress and PHP sites on each server automatically.

Can you scan without affecting customers' sites?

Scans are read-only and designed for production servers. Changes only happen when a Fix or Harden action is chosen, and containment is targeted at the affected account so other tenants carry on as normal.

Can you help with abuse complaints?

Yes. We trace a complaint to the account and script responsible, contain it and give you a short written summary of what was found and done, which you can use to respond to the complaint.

Do we need to give you root access?

Server-wide scanning needs an SSH key for a user with sudo rights, because persistence planted at root level is otherwise invisible. Access is recorded in the Activity log and you can revoke the key at any time.

Malware scanning and clean-up for hosting providers