Edge antivirus cordon
Palace Guard
Palace Guard is Zipper’s antivirus and data-loss cordon at the gate. Eighteen engines inspect uploads and stored objects while they are still in flight — never detonating the sample. The classic layers match known malware hashes, EICAR, a Zipper canary, web-shell names, filename tricks, MIME polyglots, SVG/PDF/GIF smuggle, and ZIP headers without opening a bomb. The flagship layers add a Shannon-entropy sweep for packed or encrypted payloads, steganography detection for data stowed past a JPEG EOI / PNG IEND / GIF trailer, homoglyph detection for mixed-script filenames that spoof a trusted name, CVE exploit bodies (Log4Shell, Shellshock, Struts OGNL, Spring4Shell), and a secret scanner that surfaces leaked AWS, GitHub, Slack, Stripe, and Google keys plus PEM private keys and JWTs. Bad Gallery, Archives, Video, Site Hosting HTML, inbound mail, and function source are held. Quarantined hashes stay held when served. You can watch the scan on the dashboard.
In plain English — An antivirus scanner at the gate. Every upload is checked for malware, hidden payloads, and leaked secret keys before it is stored or shared.
Palace Guard on patrol
Live cordon
Drop a file onto the pad. Palace Guard matches hashes, filename tricks, MIME polyglots, SVG/PDF/GIF smuggle, ISO polyglots, ZIP headers, CVE exploit bodies, leaked credentials, homoglyph names, and packed payloads — and never detonates the object. Gallery, Archives, Video PUT, Site Hosting HTML, inbound mail, and function source hit this same cordon. Quarantined hashes stay held on serve. This public cordon returns a live verdict. Sign in to store findings in your workspace ledger.
18 engines armed · detonation-free
Hash reputation
CISA-class published sample digests.
EICAR sentinel
Industry antivirus test file.
Guard canary
First-party sentinel object.
MIME polyglot
PE/ELF/LNK/ZIP/PDF bytes wearing a media type.
Cordon names
Web-shell filenames and double extensions.
Filename tricks
RLO, null byte, NTFS ADS, trailing junk.
Archive headers
ZIP walk without inflating — bombs cannot detonate.
Script miners
Coinhive, CryptoNight, XMRig strings.
Script smuggle
SVG/PDF/GIF/HTML stowed scripts.
Web shells
PHP/ASP/JSP eval, obfuscation, reverse shells.
Ransomware notes
HOW_TO_DECRYPT-class ransom notes.
Office macros
OLE VBA projects and macro-enabled files.
PDF launch
PDF JavaScript and embedded-file auto-open.
Entropy sweep
newShannon entropy flags packed, encrypted, or appended payloads.
Steganography
newData stowed past a JPEG EOI, PNG IEND, or GIF trailer.
Homoglyph names
newCyrillic / Greek / fullwidth look-alike characters spoof a trusted name.
CVE exploit bodies
newLog4Shell JNDI, Shellshock, ProxyShell, PrintNightmare and more.
Credential leak
newPrivate keys, AWS/GitHub/Slack/Stripe tokens, and JWTs in uploads.
Zipper at the edge
Powered by tinyzipper.com
- ▸ Eighteen engines, detonation-free
- ▸ Entropy sweep for packed payloads
- ▸ Steganography stowaway detection
- ▸ Log4Shell / Shellshock CVE bodies
- ▸ Credential-leak DLP scanner
- ▸ Homoglyph filename spoofing
- ▸ Cordon-before-disk ingest
- ▸ Animated live patrol
Auto-provisioned on every new zone. Read the Palace Guard docs, including use cases and API examples. Manage it from the dashboard after you create an account.
Create an account