Servury Blackbox zero-knowledge VPS - Encrypted RAM, Encrypted disk and no guest agent - from 9.99$

servury · August 24

@forest said: I am curious how you'll handle the influx of bad actors as others have pointed out. Do you have experience with it? I don't want the MJJs and phishers to catch you off-guard!

Believe me, I have experience with it. Given our positioning, a lot of people initially think Servury is bulletproof hosting, so I'm already constantly dealing with abuse reports.

@forest said: Nice reduction of attack surface! I'm curious, do you also perform other hardening measures for QEMU?

Here's our defaults at the moment :

-nodefaults
-cpu 'EPYC-v4,enforce,+kvm_pv_eoi,+kvm_pv_unhalt,vendor=AuthenticAMD'
-object 'rng-random,filename=/dev/urandom,id=rng0'
-device 'virtio-rng-pci,rng=rng0,max-bytes=1024,period=1000'
-device 'i6300esb,bus=pci.0,addr=0x4'
-watchdog-action reset
-global 'ICH9-LPC.disable_s3=1'
-global 'ICH9-LPC.disable_s4=1'
-sandbox 'on,obsolete=deny'

I'll tinker around with yours, but I think some of them might break Proxmox, not sure though, have to test.

@forest said: If you don't mind, could you post the output of lshw; lspci -v; lsmod; taskset -c 0 cpuid -1r from a guest?

https://servury.com/guest.txt

@forest said: On the non-pro tier, would it be possible to run a Tor exit if all abuse reports are forwarded to the customer and the customer handles them within 24 hours?

Not sure, I'd have to implement it first, and we would have to test drive it thoroughly. It'd be a nightmare to manage abuse that way.

@forest said: I actually wrote a guide here describing how to make the guest agent safer. If you ever end up needing features that could only be done via the guest agent like getting usage stats for the VM dashboard, you can whitelist the guest agent RPC commands so that it won't execute any dangerous ones.

OK. I will 100% be giving that a read, but part of me really likes the nuclear-no-guest-agent-at-all option. It completely kills any possibility of fuckery happening because of the guest agent.

@forest said: While this is ostensibly true, it is theoretically possible for you, with physical access, to bypass AMD SEV-SNP even using off-the-shelf hardware, although it takes some expertise and isn't trivial: https://tee.fail

Yeah this is kinda fucked to be honest, there's not much we can do to guarantee we're not doing that I reckon.

servury · August 24

@TimboJones said:

@forest said:
This is awesome! I'm very happy to see a new privacy-first provider, especially one that goes farther than merely "we take crypto and don't ask for KYC". I am curious how you'll handle the influx of bad actors as others have pointed out. Do you have experience with it? I don't want the MJJs and phishers to catch you off-guard!

Yeah, burn out from bad customers having his cell phone number is a recipe for disaster.

It's kind of my job to deal with that, we'll see how it goes though.

servury · August 24

@Obelous said:

@TimboJones said: He doesn't have much gear at this point. It's a shared box, so they'll take the drive and maybe they start taking servers due to TPM's.

He has a shit ton of nodes listed on his status page but it smells very fake. https://servury.com/status

I am very suspicious.

Yeah, those are not Blackbox nodes. Those are nodes for our regular VPS/VDS. We do not own that hardware.

Obelous · August 24

@servury said:

@Obelous said:

@TimboJones said: He doesn't have much gear at this point. It's a shared box, so they'll take the drive and maybe they start taking servers due to TPM's.

He has a shit ton of nodes listed on his status page but it smells very fake. https://servury.com/status

I am very suspicious.

Yeah, those are not Blackbox nodes. Those are nodes for our regular VPS/VDS. We do not own that hardware.

I don't really believe they're real at all. 200+ nodes in 6 months of doing business?

And I wasn't able to find anything pointing to you having that many nodes or those other locations. I can only find that 1 LG for Montreal, all your infra hosted in Montreal. DNS, Censys data, etc... also only pointing to Montreal.

Trustpilot doesn't really point to you having customers either, there's 3 reviews. You had more than 20 until Trustpilot removed all your fake 5-star reviews. https://www.trustpilot.com/review/servury.com https://web.archive.org/web/20260115143659/https://www.trustpilot.com/review/servury.com

Everything combined, it just starts smelling like shit.

cloromorpho · August 24

The jig is up buddy

forest · August 25

@servury said: Here's our defaults at the moment :

No -run-with user=qemu? Or is it being started as non-root?

luckypenguin · August 25

Nice for the non-KYC and SEV-SNP part, but your other 2 marketing "addons" are possible
with any provider. You can install your own image with disk encryption, and having the guest agent installed or alternatively blacklist it's dangerous features is entirely up to you.
9.99$/mo price is very hard to justify for only 512 MB ram, let's be honest, it's barely
enough to run just the basic OS services with this low amount.
39.99$ is a price for a reasonably ok'ish dedi, you only offer 4GB ram VPS for that.
GLWS.

servury · August 25

@forest said:

@servury said: Here's our defaults at the moment :

No -run-with user=qemu? Or is it being started as non-root?

Here's the results of my tests so far

Flag Result
resourcecontrol=deny works
elevateprivileges=deny blocks setsid(), -daemonize needs it
spawn=deny could not launch network script pve-bridge: Operation not permitted
-run-with user= starts, then leaks tap devices on shutdown

I guess the only way to get around to using your - might I say, really nice hardening flags - would be to make our own QEMU API/wrapper and ditch proxmox entirely. That's now on the roadmap.

forest · August 25

@servury said: -run-with user= starts, then leaks tap devices on shutdown

So all your QEMU processes are running as root? If so, what is the purpose of even having the sandbox?

servury · August 27

`> @forest said:

@servury said: -run-with user= starts, then leaks tap devices on shutdown

So all your QEMU processes are running as root? If so, what is the purpose of even having the sandbox?

It can't be done on Proxmox. I'll make a POC of a custom QEMU wrapper so it can be done.

forest · August 27

@servury said: It can't be done on Proxmox.

Wait... so Proxmox still runs VMs as root by default?

luckypenguin · August 27

@forest said: Wait... so Proxmox still runs VMs as root by default?

https://pve.proxmox.com/wiki/Qemu/KVM_Virtual_Machines

QEMU inside Proxmox VE runs as a root process, since this is required to access block and PCI devices.

Totally possible to harden it properly. Don't pass raw disks to guest VMs, and only pass virtio-net as network device since it acts as a buffer. The problem will be with PCI devices like GPUs, but that's rare to have GPUs in shared VM environments anyway so can be ignored.

forest · August 27

@luckypenguin said: Totally possible to harden it properly. Don't pass raw disks to guest VMs, and only pass virtio-net as network device since it acts as a buffer. The problem will be with PCI devices like GPUs, but that's rare to have GPUs in shared VM environments anyway so can be ignored.

Even with that, you can drop privileges after it uses the raw disks with e.g. VFIO.

luckypenguin · August 27

@forest said: Even with that, you can drop privileges after it uses the raw disks with e.g. VFIO.

Yeah but Proxmox entire development logic is tied around running as root. The architectural design blocks priv-dropping workarounds. ZFS, Ceph, LVM, NFS, HA, I can probably think of more. This is a too much complex over-engineered product that I think was never designed for isolated, untrusted guests sharing the same host. While it's ok in corporate setups where you don't expect guest VMs tampering with each other or the host, it has so many attack surfaces that are only waiting to be discovered.

neighhouse · August 27

Hello NSA

Marx07 · August 27

Are xmr / Tor nodes allowed?
Or Public vpns?

servury · August 28

@Marx07 said:
Are xmr / Tor nodes allowed?
Or Public vpns?

Yes, all of those are allowed on the Blackbox Pro plan

forest · August 29

@luckypenguin said: QEMU inside Proxmox VE runs as a root process, since this is required to access block and PCI devices.

@servury Note that this means that the sandboxing options you provided are useless. Nothing is stopping a compromised QEMU process from obtaining kernelmode (which is the whole purpose of a seccomp sandbox).

servury · August 29

@forest said:

@luckypenguin said: QEMU inside Proxmox VE runs as a root process, since this is required to access block and PCI devices.

@servury Note that this means that the sandboxing options you provided are useless. Nothing is stopping a compromised QEMU process from obtaining kernelmode (which is the whole purpose of a seccomp sandbox).

I'm fully aware. Like I said, I'm working on a custom QEMU wrapper to ditch Proxmox entirely, which will subsequently allow us to use hardcore turbo schizo hardening methods. Should be done by the end of next week

Yuki_ · September 3

@oloke said:

@servury said: No-JS Compatible. Servury is designed to work with JS disabled.

@Yuki_ seems like perfect product for you

Indeed I am glad to see someone is making this effort :-)
They also have a Tor and I2P domain!

@servury

If I go to place an order through the onion domain I get redirected to the clearnet domain during payment.

UI bug occurs if one were to press the "Blog" and "Compare" buttons on the payment page, they overlay each other.

There exists a captcha bypass on account creation if you navigate to the order form without being logged in.

"ISP Proxies" button on order page leads to 404. Who is your supplier of residential proxies and how do you make sure they are legitimately and ethically sourced?

"Burn" button in support chat does not work, perhaps because of a JavaScript requirement?

Yuki_ · September 3

@servury I don't want to necro my old threads, so perhaps its best fitting for you respond here. what is your stance on these two request threads?
Seeking provider that takes client communication security seriously.
Seeking provider that is understanding towards service fingerprinting and scanning of the internet.

servury · September 4

@Yuki_ said: If I go to place an order through the onion domain I get redirected to the clearnet domain during payment.

Fixed

@Yuki_ said: UI bug occurs if one were to press the "Blog" and "Compare" buttons on the payment page, they overlay each other.

Fixed, I think.

@Yuki_ said: There exists a captcha bypass on account creation if you navigate to the order form without being logged in.

Yeah I know, but it's not that big of a deal, the only real issue spam-created accounts could cause is spamming support chats, and that's behind a captcha. Matter of fact, I'll remove the captchas from signup/login pages.

@Yuki_ said: "ISP Proxies" button on order page leads to 404. Who is your supplier of residential proxies and how do you make sure they are legitimately and ethically sourced?

Fixed. We use a blend of a bunch of different bandwidth providers, which we have all made extensive research in.

@Yuki_ said: "Burn" button in support chat does not work, perhaps because of a JavaScript requirement?

Fixed.

Thanks for the list. Let me know if you find anything else. As a thank you, I'll give you one month of Blackbox Core if you signup and PM me your user ID.

servury · September 5

@forest the QEMU wrapper is done, here's our defaults now :

qemu-system-x86_64 -nodefaults -no-user-config \
-cpu EPYC-v4,enforce,-svm,pmu=off,+kvm_pv_eoi,+kvm_pv_unhalt,vendor=AuthenticAMD \
-machine pc-q35-9.2,vmport=off,hpet=off,smm=off,mem-merge=off,\
dump-guest-core=off,sata=off,smbus=off,usb=off[,confidential-guest-support=sev0] \
-accel kvm,kernel-irqchip=split \
-device bochs-display (VGA only for Windows guests) \
-object rng-builtin,id=rng0 -device virtio-rng-pci,rng=rng0,max-bytes=1024,period=1000 \
-device virtio-scsi-pci,disable-legacy=on \
-drive file=/dev/zvol/...,cache=none,aio=native,discard=unmap,detect-zeroes=unmap \
-netdev tap,...,vhost=on -device virtio-net-pci,disable-legacy=on \
-device i6300esb -action watchdog=reset \
-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny

Going back to the flag we discussed :

-run-with chroot=/var/empty,user=qemu - this is where we diverge hardest. That needs CAP_SYS_CHROOT, so QEMU still starts as root to enter it. We hand the whole job to systemd instead:

User=servury-vm # unprivileged, CapabilityBoundingSet= (empty), NoNewPrivileges
DevicePolicy=closed # + per-VM DeviceAllow for only THIS vm's disk node
TemporaryFileSystem=/run/servury:ro + BindPaths=/run/servury/%i # per-VM mount view
PrivatePIDs=yes # siblings invisible + unsignalable
RestrictAddressFamilies=AF_UNIX + IPAddressDeny=any + SocketBindDeny=any
SystemCallFilter=~@debug ... process_vm_readv process_vm_writev kcmp
MemorySwapMax=0, LimitCORE=0

servury · September 5

@Yuki_ said:
@servury I don't want to necro my old threads, so perhaps its best fitting for you respond here. what is your stance on these two request threads?
Seeking provider that takes client communication security seriously.
Seeking provider that is understanding towards service fingerprinting and scanning of the internet.

As for "providers that takes client communication security seriously" - You're more than welcome to message us via e-mail or the support chat and use PGP.

As for mass port scanning, it's not allowed, it's the type of activity that gets our IP ranges burned with garbage rep.

forest · September 5

@servury said: hpet=off

But why?

@servury said: -run-with chroot=/var/empty,user=qemu - this is where we diverge hardest. That needs CAP_SYS_CHROOT, so QEMU still starts as root to enter it. We hand the whole job to systemd instead:

Using -run-with does require root to start out with, but it's safe because QEMU will drop its privileges immediately after. But if you're using systemd to create a read-only mount namespace, it should be fine.

servury · September 5

@forest said:

@servury said: hpet=off

But why?

@servury said: -run-with chroot=/var/empty,user=qemu - this is where we diverge hardest. That needs CAP_SYS_CHROOT, so QEMU still starts as root to enter it. We hand the whole job to systemd instead:

Using -run-with does require root to start out with, but it's safe because QEMU will drop its privileges immediately after. But if you're using systemd to create a read-only mount namespace, it should be fine.

it's dead weight, it goes in the same bucket as sata=off,smbus=off,usb=off.

Also, systemd gives us more than a chroot. Each QEMU gets a mount namespace where the shared trees (/run/servury, /var/lib/servury/vm, /etc/servury/vms) contain only its own sockets, disk and spec; a device cgroup allowlist so a neighbour's zvol is EPERM at open; private PIDs; AF_UNIX only with IPAddressDeny=any; and a second seccomp filter on top of -sandbox that closes ptrace/process_vm_readv, which QEMU's own filter leaves open. A chroot into /var/empty gives you the filesystem part of that and none of the rest.

With User= in the unit, QEMU is never root at any instant, and the empty capability set is true from execve onward, which is what makes it checkable from outside (CapEff 0000000000000000 in /proc/PID/status for the life of the process). It also takes QEMU's own privilege-drop code out of the trust path.

brodiechilliam · October 13

@servury said:
I'm Matteo, I run Servury, a 100% anonymous VPS/VDS provider platform. Today, I'm thrilled to present to you our new product - Blackbox, which I believe is the first of it's kind. It's a zero knowledge VPS, where even we (the hypervisor) can't read your VM's memory, disk, or run arbitrary commands inside of it.

Every hosting provider on this forum can do three things to your VPS. They can dump your RAM from the hypervisor. They can execute commands inside your guest without your SSH key. And they can read your disk by mounting it from the host. That is not a knock on anyone - it is simply how virtualisation works, and every provider here, including the big ones, sits in that position whether they want to or not.

This is a box where we can't do any of the three. Not "we promise not to" or "we have a policy". The capability is removed, and you can verify all of it from inside your own VM.

We are not the cheapest box on this forum and we're not trying to be. If you want 4 GB for $20/year, that offer exists and it isn't this one. What you're paying for is a machine its operator cannot look inside.

The three things, and how you check them yourself

1. We can't read your memory

AMD SEV-SNP. Your guest's RAM is encrypted with a key that lives in the CPU's security processor.
$ dmesg | grep -i "Memory Encryption"
Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP

$ dmesg | grep VMPL
SEV: SNP running at VMPL0.
And you don't have to take that output on faith either, because the attestation device is exposed to you:
$ ls -l /dev/sev-guest
crw------- 1 root root 10, 262 /dev/sev-guest
That is the interface to the AMD PSP. You can pull a signed attestation report from the silicon and check it against AMD's root of trust yourself. We cannot forge it and we cannot intercept it.

2. We can't reach into your guest

Nearly every VPS you have ever rented runs a guest agent - a daemon inside your VM listening on a virtio serial port, which lets the host run commands as root inside your guest, read arbitrary files, and reset your password. It is how "reset root password" works in a control panel. It is enabled by default in Proxmox, and both Azure and GCP keep their agents running inside confidential VMs too.

On a Servury Blackbox there is no agent, and no port for one. It isn't disabled in software where it could be switched back on - the virtio-serial device is absent from the QEMU command line entirely. From inside your VM:
$ ls /dev/virtio-ports/ 2>/dev/null
(nothing - there is no org.qemu.guest_agent.0)
Because the channel does not exist, "reset my root password from the panel" is a feature we genuinely cannot offer you on a Blackbox VM. If we have the ability to reset your root password, you're forced to trust we won't tamper with your VM at any given time, which is utter garbage in our opinion. Don't trust, verify.

3. We can't read your disk

Optional LUKS full-disk encryption, unlocked over SSH by dropbear in the initramfs. You set the passphrase yourself on first boot and it never touches our systems. Combined with the above: your disk is ciphertext at rest, your RAM is ciphertext in use, and the key exists only in encrypted memory we can't read.

And we don't know who you are

No email, no phone, no KYC. Signup hands you a credential and that is the whole account. Payment is 11 coins through our own processor - our node, our watcher, no third party in the middle collecting your addresses and your IP - or Stripe, or cash by mail.

Zero logs. No access logs anywhere on the platform, including the looking glass below. This is the only thing you can't really verify. See Trusting Trust (Ken Thompson, 1984). We'll be looking into getting an audit done in the future.

No-JS Compatible. Servury is designed to work with JS disabled. For people who pay with credit cards, we only load the Stripe assets when credit card is explicitely selected as a payment method.

Kickass features

We own the whole stack. AS395904, 23.155.44.0/24, 2602:f41c::/36, our own switch, our
own hardware at Cologix MTL2. If you traceroute the looking glass you are looking at the same path your VM sits behind, because it is literally an address out of the same /24 your VM gets assigned from.

BYOIP Bring your own prefix and we announce it from AS395904, v4 and v6, as buttons in the panel rather than a ticket. RPKI verification is automated.

rDNS you set yourself, in the panel, not by ticket.

12 OS templates, all UEFI, all built by hand: Debian 12/13, Ubuntu 24.04/26.04, Rocky 9, AlmaLinux 9/10, FreeBSD 14/15, OpenBSD 7.8/7.9, Windows Server 2025.

Manual abuse report handling, on the Pro tier.

Priority human support, from me, the founder. On the pro tier you get my cellphone number.

Plans

Both plans are on the Montreal node (Cologix MTL2). Every plan: 1 dedicated IPv4 + a routed /64 IPv6, 10 Gbps unmetered, NVMe on a ZFS mirror, full root, KVM.

Plan vCPU RAM Disk Price

Blackbox Core 1 512 MB 50 GB NVMe $9.99/mo

Order: https://servury.com

Need something bigger? The nodes are 32c/64t EPYC with 250 GB of RAM and 7 TB of NVMe, so there is a lot of room above the Pro plan. I'll build a custom spec - more cores, more RAM, a big volume, whatever you actually need - on 6 months prepaid. Tell me the spec and I'll quote it in the thread so everyone can see the number.

Looking glass, test IPs, test files

https://mtl-lg.servury.com

Looking glass IPv4: 23.155.44.21

Looking glass IPv6: 2602:f41c:0:a::1

Test files: 100 MB / 1 GB / 10 GB

iperf3: iperf3 -c mtl-lg.servury.com -p 5201 -P 4 (add -R for the other direction)

The looking glass keeps no access log and records no visitor IP addresses - same as the rest of the platform. It also serves Bootstrap from our own host rather than a CDN, so opening it doesn't hand your address to a third party either.

YABS

Blackbox Pro - 2 vCPU / 4 GB / 50 GB
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## #
#              Yet-Another-Bench-Script              #
#                     v2026-07-24                    #
# https://github.com/masonr/yet-another-bench-script #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## #

Fri Aug 21 01:49:49 AM UTC 2026

Basic System Information:
---------------------------------
Uptime     : 0 days, 0 hours, 1 minutes
Processor  : AMD EPYC-v4 Processor
CPU cores  : 2 @ 2794.748 MHz
AES-NI     : ✔ Enabled
VM-x/AMD-V : ❌ Disabled
RAM        : 3.8 GiB
Swap       : 0.0 KiB
Disk       : 49.1 GiB
Distro     : Debian GNU/Linux 13 (trixie)
Kernel     : 6.12.101+deb13-amd64
VM Type    : KVM
IPv4/IPv6  : ✔ Online / ✔ Online

IPv6 Network Information:
---------------------------------
ISP        : Servury
ASN        : AS395904 Servury
Host       : Servury
Location   : Montreal, Quebec (QC)
Country    : Canada

fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/sda3):
---------------------------------
Block Size | 4k            (IOPS) | 64k           (IOPS)
  ------   | ---            ----  | ----           ---- 
Read       | 281.33 MB/s  (68.6k) | 3.68 GB/s    (56.1k)
Write      | 282.08 MB/s  (68.8k) | 3.69 GB/s    (56.4k)
Total      | 563.42 MB/s (137.5k) | 7.37 GB/s   (112.6k)
           |                      |                     
Block Size | 512k          (IOPS) | 1m            (IOPS)
  ------   | ---            ----  | ----           ---- 
Read       | 12.83 GB/s   (24.4k) | 3.39 GB/s     (3.2k)
Write      | 13.51 GB/s   (25.7k) | 3.62 GB/s     (3.4k)
Total      | 26.34 GB/s   (50.2k) | 7.01 GB/s     (6.6k)

iperf3 Network Speed Tests (IPv4):
---------------------------------
Provider        | Location (Link)           | Send Speed      | Recv Speed      | Ping           
-----           | -----                     | ----            | ----            | ----           

Clouvider       | London, UK (10G)          | 2.31 Gbits/sec  | 3.11 Gbits/sec  | 71.6 ms        

Eranium         | Amsterdam, NL (100G)      | 2.70 Gbits/sec  | 3.02 Gbits/sec  | 79.7 ms        

Uztelecom       | Tashkent, UZ (10G)        | 1.08 Gbits/sec  | 1.12 Gbits/sec  | 169 ms         

Leaseweb        | Singapore, SG (10G)       | 643 Mbits/sec   | 900 Mbits/sec   | 246 ms         

Clouvider       | Los Angeles, CA, US (10G) | 3.28 Gbits/sec  | 3.83 Gbits/sec  | 57.8 ms        

Leaseweb        | NYC, NY, US (10G)         | 9.17 Gbits/sec  | 8.40 Gbits/sec  | 9.92 ms        

Edgoo           | Sao Paulo, BR (1G)        | 1.59 Gbits/sec  | 1.99 Gbits/sec  | 119 ms         

iperf3 Network Speed Tests (IPv6):
---------------------------------
Provider        | Location (Link)           | Send Speed      | Recv Speed      | Ping           
-----           | -----                     | ----            | ----            | ----           

Clouvider       | London, UK (10G)          | 2.64 Gbits/sec  | 3.03 Gbits/sec  | 70.6 ms        

Eranium         | Amsterdam, NL (100G)      | 2.63 Gbits/sec  | 3.06 Gbits/sec  | 80.3 ms        

Uztelecom       | Tashkent, UZ (10G)        | 1.04 Gbits/sec  | 1.26 Gbits/sec  | 169 ms         

Leaseweb        | Singapore, SG (10G)       | 694 Mbits/sec   | 905 Mbits/sec   | 239 ms         

Clouvider       | Los Angeles, CA, US (10G) | 3.26 Gbits/sec  | 3.92 Gbits/sec  | 57.8 ms        

Leaseweb        | NYC, NY, US (10G)         | 9.22 Gbits/sec  | 9.23 Gbits/sec  | 10.0 ms        

Edgoo           | Sao Paulo, BR (1G)        | 1.62 Gbits/sec  | 2.00 Gbits/sec  | 125 ms         

---------------------------------
Test            | Value                         
                |                               
Single Core     | 1809                          
Multi Core      | 3316                          
Full Test       | https://browser.geekbench.com/v6/cpu/19039180

YABS completed in 13 min 23 sec
Blackbox Core - 1 vCPU / 512 MB / 50 GB

Geekbench : GB6 does not fit in 512 MB.
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## #
#              Yet-Another-Bench-Script              #
#                     v2026-07-24                    #
# https://github.com/masonr/yet-another-bench-script #
# ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## #

Fri Aug 21 01:19:20 AM UTC 2026

Basic System Information:
---------------------------------
Uptime     : 0 days, 0 hours, 1 minutes
Processor  : AMD EPYC-v4 Processor
CPU cores  : 1 @ 2794.748 MHz
AES-NI     : ✔ Enabled
VM-x/AMD-V : ❌ Disabled
RAM        : 396.8 MiB
Swap       : 0.0 KiB
Disk       : 49.1 GiB
Distro     : Debian GNU/Linux 13 (trixie)
Kernel     : 6.12.101+deb13-amd64
VM Type    : KVM
IPv4/IPv6  : ✔ Online / ✔ Online

IPv6 Network Information:
---------------------------------
ISP        : Servury
ASN        : AS395904 Servury
Host       : Servury
Location   : Montreal, Quebec (QC)
Country    : Canada

fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/sda3):
---------------------------------
Block Size | 4k            (IOPS) | 64k           (IOPS)
  ------   | ---            ----  | ----           ---- 
Read       | 156.08 MB/s  (38.1k) | 1.77 GB/s    (27.0k)
Write      | 156.50 MB/s  (38.2k) | 1.77 GB/s    (27.1k)
Total      | 312.58 MB/s  (76.3k) | 3.54 GB/s    (54.1k)
           |                      |                     
Block Size | 512k          (IOPS) | 1m            (IOPS)
  ------   | ---            ----  | ----           ---- 
Read       | 6.43 GB/s    (12.2k) | 7.66 GB/s     (7.3k)
Write      | 6.77 GB/s    (12.9k) | 8.17 GB/s     (7.8k)
Total      | 13.21 GB/s   (25.2k) | 15.84 GB/s   (15.1k)

iperf3 Network Speed Tests (IPv4):
---------------------------------
Provider        | Location (Link)           | Send Speed      | Recv Speed      | Ping           
-----           | -----                     | ----            | ----            | ----           

Clouvider       | London, UK (10G)          | 2.00 Gbits/sec  | 1.62 Gbits/sec  | 71.2 ms        

Eranium         | Amsterdam, NL (100G)      | 1.44 Gbits/sec  | 1.42 Gbits/sec  | 80.2 ms        

Uztelecom       | Tashkent, UZ (10G)        | 805 Mbits/sec   | 633 Mbits/sec   | 169 ms         

Leaseweb        | Singapore, SG (10G)       | 504 Mbits/sec   | 428 Mbits/sec   | 241 ms         

Clouvider       | Los Angeles, CA, US (10G) | 2.48 Gbits/sec  | 2.03 Gbits/sec  | 57.0 ms        

Leaseweb        | NYC, NY, US (10G)         | 9.28 Gbits/sec  | 9.14 Gbits/sec  | 9.61 ms        

Edgoo           | Sao Paulo, BR (1G)        | 1.11 Gbits/sec  | 976 Mbits/sec   | 117 ms         

iperf3 Network Speed Tests (IPv6):
---------------------------------
Provider        | Location (Link)           | Send Speed      | Recv Speed      | Ping           
-----           | -----                     | ----            | ----            | ----           

Clouvider       | London, UK (10G)          | 2.02 Gbits/sec  | 1.58 Gbits/sec  | 70.7 ms        

Eranium         | Amsterdam, NL (100G)      | 1.85 Gbits/sec  | 1.38 Gbits/sec  | 80.2 ms        

Uztelecom       | Tashkent, UZ (10G)        | 863 Mbits/sec   | 577 Mbits/sec   | 169 ms         

Leaseweb        | Singapore, SG (10G)       | 500 Mbits/sec   | 407 Mbits/sec   | 249 ms         

Clouvider       | Los Angeles, CA, US (10G) | 2.39 Gbits/sec  | 1.92 Gbits/sec  | 57.8 ms        

Leaseweb        | NYC, NY, US (10G)         | 8.98 Gbits/sec  | 9.21 Gbits/sec  | 10.1 ms        

Edgoo           | Sao Paulo, BR (1G)        | 1.15 Gbits/sec  | busy            | 118 ms         

YABS completed in 7 min 5 sec
Network summary, from the Pro run - Montreal is a good place to sit if you care about the US
northeast:

Destination Send Recv Ping

NYC 9.34 Gbit/s 9.35 Gbit/s 9.8 ms

Los Angeles 3.33 Gbit/s 4.15 Gbit/s 57 ms

London 2.19 Gbit/s 3.00 Gbit/s 71 ms

Amsterdam 2.66 Gbit/s 3.10 Gbit/s 80 ms

Sao Paulo 1.57 Gbit/s 2.01 Gbit/s 117 ms

Terms

Prohibited: anything illegal, CSAM, fraud/phishing, unauthorised attacks on other systems,
spam, cryptocurrency mining, and IP infringement. Violations mean suspension without refund.

We process abuse reports from law enforcement with valid legal process, NCMEC, our network
transit, and valid DMCA notices.

Full terms: https://servury.com/terms/

Contact

Web: https://servury.com

Email: [email protected]

Here

Happy to run any test you want on the looking glass, and if there's a specific YABS variant or a benchmark you'd like to see on one of these plans, ask and I'll post it.

eh, too expensive and all you do is some useless stuff + encrypted disk, like bro who cares if u are able to check how much memory their VM is using and like wdym I cant even port scan while paying $9.99/mo for 512mb of ram

servury · October 13

@brodiechilliam said: eh, too expensive and all you do is some useless stuff + encrypted disk, like bro who cares if u are able to check how much memory their VM is using and like wdym I cant even port scan while paying $9.99/mo for 512mb of ram

We updated the pricing a long time ago. Here is the new offer thread :

https://lowendtalk.com/discussion/220847/blackbox-2-vcpu-4-gb-50-gb-nvme-encrypted-ram-disk-100-anonymous-9-99-mo

AMD SEV-SNP doesn't hide how much memory you're using, it hides WHAT is in memory.

bluesega · October 13

Honestly, just because it's a unique product which points in the right direction, I'll probably at least check it out in the future. Very cool.

nghialele · October 13

I am interest

Howdy, Stranger!

Categories

In this Discussion

Servury Blackbox zero-knowledge VPS - Encrypted RAM, Encrypted disk and no guest agent - from 9.99$

Comments

The three things, and how you check them yourself

1. We can't read your memory

2. We can't reach into your guest

3. We can't read your disk

And we don't know who you are

No-JS Compatible. Servury is designed to work with JS disabled. For people who pay with credit cards, we only load the Stripe assets when credit card is explicitely selected as a payment method.

Kickass features

Plans

Looking glass, test IPs, test files

YABS

Blackbox Pro - 2 vCPU / 4 GB / 50 GB

Blackbox Core - 1 vCPU / 512 MB / 50 GB

Terms

Contact

Destination	Send	Recv	Ping
NYC	9.34 Gbit/s	9.35 Gbit/s	9.8 ms
Los Angeles	3.33 Gbit/s	4.15 Gbit/s	57 ms
London	2.19 Gbit/s	3.00 Gbit/s	71 ms
Amsterdam	2.66 Gbit/s	3.10 Gbit/s	80 ms
Sao Paulo	1.57 Gbit/s	2.01 Gbit/s	117 ms

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Servury Blackbox zero-knowledge VPS - Encrypted RAM, Encrypted disk and no guest agent - from 9.99$

Comments

The three things, and how you check them yourself

1. We can't read your memory

2. We can't reach into your guest

3. We can't read your disk

And we don't know who you are

No-JS Compatible. Servury is designed to work with JS disabled. For people who pay with credit cards, we only load the Stripe assets when credit card is explicitely selected as a payment method.

Kickass features

Plans

Looking glass, test IPs, test files

YABS

Blackbox Pro - 2 vCPU / 4 GB / 50 GB

Blackbox Core - 1 vCPU / 512 MB / 50 GB

Terms

Contact