We Stopped Building Walls and Built an Immune System

From March onward, we were in a fight we kept losing the same way. A crypto miner would turn up on our infrastructure. We'd kill it, clean up, harden. Days later it would be back. Antivirus ran the whole time and saw nothing. At one point we even had the hosting provider's own AI assistant auditing the box — it missed it too. Different signature, same outcome, over and over.

At some point you stop asking "how do we build a taller wall" and start asking "why does the wall keep failing." And the answer reframed everything we did next.

Signatures are a losing game

Traditional defense is signature-based. Antivirus knows what known-bad looks like — this file hash, that binary name, this byte pattern — and blocks it. It works right up until the attacker changes the signature, which costs them about thirty seconds. We were playing whack-a-mole against an opponent who could repaint the mole between every swing.

So we inverted it. The insight that became our first real tool: you cannot change what a thing has to do, only what it looks like while doing it. A crypto miner can rename its binary, repack itself, hide in any directory you like. But it cannot stop pinning the CPU. It cannot stop speaking the mining pool's protocol over the network. It cannot stop being a process that consumes everything and phones a pool home. The disguise is infinitely mutable. The behavior is not.

That became CryptoAnnihilator — a miner detector that ignores what the malware is called and watches what it does. It looks at four things at once: the network layer (the Stratum mining protocol has a handshake it can't fake), the behavioral layer (sustained maximum CPU paired with steady outbound traffic), the known-bad layer (names and pool addresses, for the lazy ones), and a fingerprint layer for the evasive ones. The tagline we put on it says it plainly: antivirus recognizes the virus's DNA, so attackers change the DNA. CryptoAnnihilator recognizes the sickness. You can't mine without the symptoms.

It's a single file, no dependencies, open source. We didn't keep it. The thing that kept beating us became the thing we gave away.

We can't hack back. We were never helpless.

Once we could reliably see the activity, the next temptation was obvious and we want to be honest that we felt it: hit back. Don't just block the attacker — go after the infrastructure attacking us.

We didn't, and not only out of virtue. The infrastructure scanning you is very often some other victim's hijacked machine. Strike back and you may be attacking the next person down the chain, not the attacker. You genuinely cannot tell from the outside whose box it really is. That single fact is why offense is off the table for a defender — and it's the constraint that forced us to get creative about what defense can actually do.

It turns out: a lot.

We can slow them down. You can't attack an attacker, but you can make yourself miserable to attack. A tarpit deliberately drags out every connection an automated scanner opens — holds it, feeds it nothing, wastes its time. Multiply that across a botnet running on a clock and you've imposed real cost on them without touching anyone else. It's pure defense that happens to hurt.

We can watch. This is the part that changed how we think. Every hostile thing that happens on infrastructure we control is a free, first-hand lesson in how the attackers actually operate — what their bots scan for, in what order, with what tools. So we built a server designed to be attacked: a honeypot, scannersend.org, that invites the activity AV and the provider's AI both missed, and records exactly how it unfolds. Our worst incident taught us more about real-world intrusion than any course could, because it was real. The honeypot makes that lesson repeatable instead of accidental.

We can share. A single server learning from a single attacker is interesting. A fleet that shares what each node learns is something else. When the honeypot sees an attacker, that attacker's fingerprint propagates to every other machine we run, automatically, on a short timer — so a probe against one box becomes a closed door on all of them. The bans expire on their own, so we never permanently punish a recycled address. We call it the Immune Amplifier, and the name is the whole idea.

An immune system, not a wall

That's the frame we landed on, and it's not a metaphor we reach for to sound clever — it's the actual architecture. A wall has one job and fails the first time someone gets over it. An immune system expects to be breached. It treats every exposure as information. It learns the shape of the threat and remembers it everywhere at once, so the second encounter is nothing like the first.

The honeypot is the antigen — controlled exposure to the real pathogen. The detector is the response. The amplifier is the acquired immunity that spreads the lesson fleet-wide. A honeypot that only logs is a sensor with no effector — an eye with no hand. Wired into the fleet, it becomes the thing that makes the whole organism harder to infect every time it gets poked.

What we'd tell you to take from this

We didn't set out to build a security company. We got attacked, repeatedly, by tools that beat the defenses everyone told us to trust, and we built what actually worked instead.

• Defend behavior, not signatures. The disguise is free to change; the function isn't. Watch the function.
• You can't hack back — and you don't have to. Slow them down, study them on your own ground, and share what you learn. That's three legal, effective levers that don't require touching anyone else's machine.
• Treat every breach as a lesson, not just a loss. The intrusion that beats you is also the most honest teacher you'll ever get, if you build the thing that's listening when it happens.

We can't reach out and stop the people attacking us. But we can make our own infrastructure learn faster than they can adapt — and turn every attack into the reason the next one fails.