Serve zero threats.

malwatch guards your web servers — Yara signatures, real-time monitoring and quarantine actions — stamping every file CLEAN or THREAT before it ever reaches a visitor.

Start scanning → Get the source

» awaiting package

How it works

Three moves. No escape.

Install

One binary, zero deps

Drop malwatch anywhere on your server — no packages to install, no agents to babysit. Signatures are included.

$ tar -C /opt/malwatch -xzvf malwatch.tgz
$ ln -s /opt/malwatch/malwatch /usr/local/bin

Scan

Every byte gets a verdict

Point it at a path or let malwatch-monitor watch in real time. Files stream through the gate one by one.

$ malwatch scan /var/www/html
✓ index.php ············ CLEAN
✗ cache/7c11.php ······· THREAT
24812 files · 41s · 1 quarantined

Quarantine

Threats never serve

You decide the outcome of every detection — from a quiet alert to full exile, with a structured record kept.

ALERT QUARANTINE CLEAN EXILE

Capabilities

A belt that never blinks.

Yara signature engine

Comprehensive signature set included, with seamless updates delivered from a git-backed repo.

Real-time monitoring

malwatch-monitor watches files as they change — a queue design keeps CPU and memory flat, no matter the volume.

Quarantine vault

Alert, quarantine, clean or exile — complete control over the outcome of every detection.

Featherweight footprint

~22 MiB of memory and a low CPU profile even under full load — built for the busiest servers.

Alerting everywhere

PagerDuty, email and custom JSON out of the box — wire in your own via the simple, powerful API.

Integrates anywhere

Structured JSON logs, an ACID-compliant record store and cPanel drop-in support. Standalone or fleet-wide.

Ready when you are

Put your servers on the belt.

Free and open source under AGPL-3.0. Sponsor the project if it keeps your fleet clean.

Start scanning — it's free

$ malwatch scan /var/www/html