EcomScan scans your server files with 6 detection engines — signatures, YARA, heuristics, IOC matching, exploit detection, and CVE scanning. Deploy the korp CLI agent, scan your store, get a SOC-grade incident report in seconds.
Every script load, integrity diff, login, and checkout behavior across your fleet — streamed to a single timeline. Grouped into incidents, scored, and routed to the right channel.
We started with the four attacks that actually take stores down — and instrumented the layers attackers touch when they do.
28 compiled regex patterns and 5 YARA rule files match webshells, skimmers, backdoors, and obfuscated malware across PHP, JS, and HTML files.
40+ behavioral signals detect zero-day threats without signatures — eval chains, XOR encoding, entropy anomalies, exfiltration patterns, and payment form hooks.
Scans WordPress MySQL tables for injected scripts, rogue admin accounts, fake plugins, SEO spam, cron backdoors, and URL hijacking — reads wp-config.php automatically.
Matches installed plugins against NVD, WPScan, and Wordfence vulnerability databases. Flags outdated versions, known exploits, and CISA KEV entries.
Generate SOC-grade incident reports with one flag: --report. 10-section reports with executive summary, critical threats, action plan, and technical appendix. Email with --email.
Send alerts to Slack, PagerDuty, Jira, Splunk, Datadog, Elasticsearch, MS Teams, Cloudflare (auto-block), and any HTTPS webhook with HMAC signing.
We instrument the checkout DOM, not the homepage. The moment a script attaches to a card-input field, intercepts a fetch, or mounts an iframe overlay on a payment route, ecomscan correlates the fingerprint against 28 known families and 6 behavioral classes.
Synthetic checkouts every 60 seconds from clean browsers in five regions. Every load is diffed against a known-good baseline: scripts attached, network requests made, fields hooked, headers returned.
p.jsCopy the korp binary to your server, run korp scan --path /var/www/html --db-scan, and get a full incident report in under 30 seconds. No agent install, no browser tag, no configuration.