Diagnosis
Immediate recall: symptoms, system, host, exposed services, available access, backup status.
Server Emergency — 24/7
Hacked Server — control recovery within 24 hours
Linux, Windows, shared or dedicated VPS, containers: we regain control without disrupting production.
- Mining, outgoing spam, blacklisted IP, rootkit, unknown scheduled task: we identify and clean
- Search for persistent access — SSH keys, hidden accounts, modified binaries
- Immediate callback — no obligation, no online payment
Critical incident? Call now+33 7 82 70 38 30
or leave your contact details:
An expert will call you back in under 5 minutes
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no obligation.
150+
audited companies
SINCE 2016
72 h
first response
INCIDENT RESPONSE
1 247
vulnerabilities reported
ALL AUDITS
Included
re-test after correction
ALL OFFERS
Compromised Server
Your server is working for someone else
A compromised server is rarely taken offline: it's being used. Mining, sending spam, relaying attacks, storing illicit files. As long as it's running, your domain name and IP address bear the responsibility.
- Abnormal continuous CPU load, fans at full speed, cloud bills skyrocketing for no reason.
- Your IP is blacklisted: your legitimate emails are no longer reaching your clients.
- Your host has sent you an abuse warning, or has already suspended the service.
- Unknown processes, cron jobs, or services, system binaries with modified modification dates.
- Successful SSH connections from foreign IP addresses in authentication logs.
Linux and Windows servers, VPS, dedicated servers, cloud instances, Docker containers. Interventions for businesses and professionals.
Intervention
Takeover without breaking prod
On a compromised server, the question isn't just about cleaning: it's about whether we can clean or if we need to rebuild. We settle this question first.
Analysis
Active processes and connections, scheduled tasks, SSH accounts and keys, authentication logs, binary integrity, exposed services.
Clean or rebuild
Reasoned decision. In case of deep kernel or system compromise, we rebuild cleanly and migrate healthy data rather than patching.
Hardening & blacklist removal
Closing unnecessary services, key-based authentication, firewall, updates, then blacklist removal requests if the IP is concerned.
While waiting for our call
First steps compromised server
- Do not reinstall or restart the server: you would lose active processes and in-memory traces.
- Cut off external access if you can do so at the firewall or host panel level.
- Do not modify suspicious files: their modification date is important information.
- Immediately back up logs (/var/log, authentication logs, web server logs) off the machine.
- Change passwords and keys from a clean machine, and revoke the server's API tokens.
- Take your backups offline: a compromised server can reach accessible backups.
What our clients say
We don't rate ourselves.
Reviews published on our Google listing by companies that have actually been audited. Verifiable, one by one.
GOOGLE
We hired White-Hat to conduct a cybersecurity audit of all our servers, and we are very satisfied with the quality of their work. Philippe demonstrated professionalism, responsiveness, and excellent communication skills throughout the entire process. The recommendations provided were clear, relevant, and immediately actionable to strengthen our security. We highly recommend their services.
GOOGLE
Excellent experience with White-Hat for a comprehensive security audit of our SaaS platform. The quality of service was truly outstanding: Philippe took the time to understand our application's architecture before starting the tests, which made all the difference to the relevance of the results. The report was detailed, with vulnerabilities categorized by criticality, concrete evidence of exploitability, and recommendations directly applicable by our technical team. The post-delivery follow-up to verify the patches was a real bonus. Professional, rigorous, and attentive: exactly what you need to secure a SaaS product.
GOOGLE
We hired White-Hat for a comprehensive audit/advanced penetration test on our website, and it's clearly the direct contact with Philippe that makes all the difference. No salesperson between us, no unnecessary jargon: we communicate directly with someone who understands our challenges and can clearly explain the vulnerabilities found. The report was precise, with concrete evidence and recommendations that we were able to implement quickly. A truly trustworthy relationship; I highly recommend them.
GOOGLE
Professional work. Thank you.
GOOGLE
We urgently contacted White Hat following a suspected compromise of several servers. The team was extremely responsive and addressed our request within minutes, with clear communication at every stage. Their vulnerability analysis was conducted very rigorously, resulting in a detailed report and concrete, easy-to-implement recommendations to strengthen our security. The investigation of the compromised servers allowed them to quickly identify the source of the attack and contain the incident without any major disruption to our services. Professional, knowledgeable, and readily available, I highly recommend this provider for any cybersecurity intervention, especially in emergency situations.
Scope
We intervene on
Server compromises
Cryptocurrency mining, spam relay, rootkit, backdoor, malicious cron job, illegitimate SSH key, exploited exposed service, compromised container.
Environments
Linux (Debian, Ubuntu, CentOS, Alma), Windows Server, OVH, Scaleway, Hetzner VPS and dedicated servers, AWS, Azure, Docker and lightweight orchestration.
Out of scope
No long-term management during the emergency phase, no architecture migration, no application development.
Dedicated contact
Philippe Bécué servers & infrastructure
A VPS mining crypto, a mail server turned into a spam relay, an SSH key added to authorized_keys three months ago: these incidents are handled by knowing the terrain, not by running an antivirus. Philippe Bécué intervenes on Linux as well as Windows, directly with your host when necessary, and frankly tells you when rebuilding costs less than cleaning.
FAQ
Server hacked
Do we need to reinstall everything?
Sometimes yes, often no. A compromise limited to a web application can be cleaned; a compromise affecting the system or kernel warrants a rebuild. This is the first question we resolve, with arguments, not by principle.
My IP is blacklisted, is it recoverable?
Yes, in the vast majority of cases. The source of the abuse must first be stopped, which is the real work, then requests for removal must be submitted to the main lists. Removal takes from a few hours to a few days depending on the operators.
Do you intervene on shared hosting?
Yes, with the limitations of shared hosting: we work at the file, database, and panel level, without system access. On VPS and dedicated servers, the intervention is much more comprehensive.
What if the host has already suspended the server?
This is common and not a blocker. We work with you and the host to obtain remediation access, often in rescue mode, to clean up and justify the service restoration.
Act
Hacked server — get a callback now
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no obligation.
Free, confidential, no obligation — no online payment.