What do you use for automated security scans on budget hosts?

Been running a few Atom C2550 boxes at Contabo for a client. €12/mo, no frills, no malware scanning included. ClamAV on cron eats 400MB RAM just to load defs. Looking at alternatives before I commit to a fleet of these.

Current shortlist:

• MalDet + ClamAV combo, ~180MB RAM after tuning
• Linux Malware Detect alone, lighter but stale sigs
• YARA rules from AbuseCH, roll your own pipeline
• Imunify360 trial on one box, $8/mo after

Anyone got numbers from production? Power draw on these Atoms is 17W idle, trying to keep overhead under 25% of host cost.

I just run maldet every sunday manual but it works no cron needed my little 1GB VPS at OVHcloud handles it fine you are overthinking this

The ticket said "my wordpress is slow" and the scan found 47 base64 webshells in uploads. User had installed a "SEO plugin" from a Facebook group. The abuse report claimed "your server attacked my bank" because the shell tried a POST to a phishing domain.

I run ClamAV + YARA in CI now. Build box pulls fresh rules, bakes AMIs, deploys to CloudCone instances. Catches most before it hits disk. The false positive on a custom invoice PDF was entertaining. The ticket said "you deleted my billing."