---
title: 'Signature Providers'
url: 'https://docs.danami.com/sentinel/settings/antivirus/signature-providers'
markdown: 'https://docs.danami.com/sentinel/settings/antivirus/signature-providers.md'
date: '2026-09-22'
description: 'Third party signatures allow you to enhance the virus detection rate of ClamAV. • These signature providers are independant from Danami therefore we have no control over them. Make sure to watch for false positives after enabling a new provider. • When a provider is enabled the provi…'
taxonomy:
  category:
    - docs
---

[](#)  [ Basics ](https://docs.danami.com/sentinel/)     [ Settings Reference ](https://docs.danami.com/sentinel/settings)     [ Antivirus ](https://docs.danami.com/sentinel/settings/antivirus)      Signature Providers    

# Signature Providers

Third party signatures allow you to enhance the virus detection rate of ClamAV.

> > > > > • **These signature providers are independant from Danami therefore we have no control over them. Make sure to watch for false positives after enabling a new provider.**
> > > > > • When a provider is enabled the provider URLs will be added to `Settings -> Signature Updates -> DatabaseCustomURL`. Signature update logs can be found under `Logs -> Signature Log`.
> > > > > • We recommend that you enable `Settings -> Anti-virus Settings -> Concurrent database reload` to allow for non-blocking (multi-threaded/concurrent) database reloads (For systems with more than 4 GB of memory).
> > > > > • Provider files are downloaded to the `/var/lib/clamav/` directory. Warden will delete a database when it is de-selected or when the provider is disabled.
> > > > > • The ClamAV daemon will use over 1 GB of memory with all the providers enabled so make sure your server has enough memory before enabling any providers.
> > > > > • These signature providers are independant from Danami therefore we have no control over them. Make sure to watch for false positives after enabling a new provider.

### InterServer

[Interserver](https://sigs.interserver.net/) is a set of free ClamAV signatures focused on malicious PHP scripts and is maintained by the hosting provider [InterServer](https://www.interserver.net/). It provides a real time suspected malware list as detected by InterServers InterShield protection system.

**interserver\_enable** - `interserver_enable`
Enable or disable the InterServer signature provider.
Default: 0

**interserver\_provider\_url** - `interserver_provider_url`
The base URL of this signature provider.
Default: https://sigs.interserver.net/

**interserver\_provider\_files** - `interserver_provider_files`
The signature database files to download from this provider.
Default: interserver256.hdb interservertopline.db shell.ldb whitelist.fp

| File | Description |
|---|---|
| `interserver256.hdb` | 100% known malware in sha256 format. |
| `interservertopline.db` | Inserts into files, manual cleaning HEX. |
| `shell.ldb` | 99.9% known malware using logical signatures. |
| `whitelist.fp` | Checksums of false positives or common files. Mandatory use for any usage. |

 [ ](https://docs.danami.com/sentinel/settings/antivirus/signature-updates) [](https://docs.danami.com/sentinel/settings/panel-application/application-settings)

---

## Navigation

- Parent: [Antivirus](https://docs.danami.com/sentinel/settings/antivirus.md)
- Previous: [Signature Updates](https://docs.danami.com/sentinel/settings/antivirus/signature-updates.md)