INTELLIGENT
piXel

Been hacked? I’ll get you out of it. Want to keep it from happening at all? Better still.

I secure servers before anyone gets in, and I reconstruct the case when someone does. I also build the software that runs on them. Since 1998, for companies, government agencies, and independent professionals, anywhere in the world.

Hardly any of my clients hear it from me that they’ve been hacked. They hear it from Google, from their hosting company, or from a customer who calls to ask why the company website is now selling erectile dysfunction pills.

If it’s already happened, order matters. The most common mistake after a break-in is a human one, not a technical one: you want it gone. So you delete. And what you delete is exactly the thing that was supposed to prove, 2 weeks later, that you weren’t negligent. Secure the evidence first, then close the hole, then clean up. I spent 25 years reconstructing how systems got compromised. The order is muscle memory.

If it hasn’t happened yet, you’re in the better position. Also the considerably cheaper one. Prevention, the way I do it, doesn’t mean installing a product and hoping. It means hardening and watching your systems closely enough that an attack shows up while it’s running, instead of when your host pulls the plug.

I don’t take every job. From the outside that makes me look hard to reach. My clients get the opposite: one contact who picks up the phone and knows their systems, because he built them. Some of them since 1998.

Write and tell me what’s going on. If I’m not the right person for it, I’ll say so. That’s rare, but it happens, and then the conversation costs you 20 minutes and nothing else.

Who’d bother attacking me, of all people?

It’s the question I hear most, and it’s completely fair. You have 14 employees, you sell dentures or ductwork, and nothing about your company screams intelligence service. So let’s do the math. Not by feel. By addresses.

The internet has 4,294,967,296 addresses. That’s not an estimate and not some industry figure. That’s 2 to the 32nd. The number has been fixed since the thing was built. Your company is one of them.

In 2013, 3 researchers at the University of Michigan released a tool called ZMap. It scans all 4.29 billion addresses. From a single machine, over an ordinary gigabit line, in under 45 minutes. That was 2013. Back when a gigabyte of storage still cost money.

45 minutes. Keep going. That’s 32 complete passes a day from one machine. Through the entire internet. Every day. And that’s one machine.

It isn’t one machine.

Your router in Starnberg, a NASA server, and the security camera at a gas station outside Rosenheim sit on the same list and get counted off in the same second. The scanner doesn’t know what NASA is. It knows that port 22 answered.

That answers your question, just not the way you asked it. Nobody decided on you. Nobody picked you out. Your number came up.

And you don’t have to take my word for it, because I keep count. Across my whole server fleet, an average of 20,000 serious attacks land every 24 hours. Serious means the background noise is already subtracted out. No harmless scans, no search engines, no misconfigured printers in Ohio. 20,000 attempts by somebody who wants something.

That’s one every 4.3 seconds. In the time it took you to read this section (about a minute), there were 14.

You’re not attacked because you’re interesting. You’re attacked because you’re reachable. That’s not a verdict on your company. That’s a loop.

One company, one standard, one person to call.

Securing and running servers. Hardening, monitoring, early warning, and if you want it, the whole operation in EU data centers under my control. You call a human being, not a ticket system that informs you your request is important to them. My own system for this is called IPServerSec.

Websites running on WordPress. Repair after a break-in, migration to my infrastructure, updates and monitoring, plugins and themes.

Software. Apps for iOS and macOS, server systems, web applications, and the interfaces in between. Plus the infrastructure underneath: my own DNS server, my own mail server, every domain you need.

AI that actually goes into production. Systems, voice agents, and chatbots, hosted in the EU, wired into the tools you already use. Not a pilot project that never goes live. There are plenty of those lying around. Plus databases and vector databases, so your own material becomes searchable and not just your folder structure.

Forensics. Once it’s happened: what happened, how the other guy got in, what he did while he was inside, and how you prove it afterward. Because we got hacked is not documentation. It’s a feeling.

Advice for the people in front of the machines. Phone, laptop, the devices that carry half a life. The open door is rarely the server. Usually it’s the phone in your pocket.

Server protection I wrote myself.

IPServerSec is my own hardening and early-warning system for Linux servers. Not a plugin I bought, not a subscription. It grew over years out of real attacks on real servers. It runs on my entire server fleet and on my clients’ systems. I don’t test it on you. I test it on me, and the 20,000 from further up is the log of those tests.

It blocks, it detects, it alerts, and it logs. That last one is what everybody underestimates. When it counts, nobody asks whether you had a protection system. They ask whether you can prove it. The gap between those questions is roughly one insurance payout.

What happens to 20,000 attempts a day

They get sorted. Some get a few hours of blocking and are gone again. The second group is the interesting one: the same networks, over and over, for weeks, the same handwriting, often the same time of day. Mostly they belong to big providers overseas that rent out servers by the tens of thousands and evidently never get around to checking what’s actually running on them.

When the same attack comes out of one of those networks for the 3rd time, I don’t block the address. I block the network. For 10 years.

Is that proportionate? No. A global provider loses access to exactly one server in Starnberg. Nobody there will notice for the rest of the company’s existence. It bothers me surprisingly little. If you can’t get your own fleet under control, you don’t need to visit mine.

That’s the whole point: a rule set somebody writes for your server. Not a default a vendor wrote once for everyone and has been administering ever since.

So nothing comes off the rack. Every server gets its own rule set, built over 3 weeks from your real traffic, because a mail server needs different rules than a store, and a database server needs different ones than a VPN gateway.

What I don’t promise: absolute security. There’s no such thing. Anyone selling it to you is selling you something else.

IPServerSec in detail

Your website is up. That says nothing about whether it’s secure.

Roughly 4 in 10 websites worldwide run on WordPress. Which is exactly why automating attacks against it pays: find one hole and you’ve found millions of targets at once. Again, nothing personal, see above.

How fast that goes was documented in July 2026 by the German Federal Office for Information Security (BSI). Cybersecurity warning on WordPress, criticality level 3 of 4, 2 chained vulnerabilities, unauthenticated code execution. Publication and the first exploitation were one weekend apart.

The average installation is carrying add-ons somebody bolted on in 2019 to get a contact form, and nobody has touched them since. Neither has the developer, by the way.

I repair hacked installations, move them onto my infrastructure, keep them current, watch them, and lock them down with IPServerSec for WordPress. Where the stock parts aren’t enough, I write plugins and themes, and I’ll go into the parts of the code nobody else wants to touch.

You get the complete source code for everything I build for you. Anyone who locks you in by withholding your code hasn’t solved a problem. He’s created a second one.

Service for WordPress

The most expensive code is the code that was easy to write.

A language model will write you a login form in 20 seconds. In the same 20 seconds it writes the hole in too. It doesn’t tell you, because it doesn’t know. Ask it afterward whether the code is secure. It’ll say yes. It always says yes.

It feels productive. It looks like it works. And almost every time, something comes out of it that none of the people involved can see.

What most people miss: one hole in an application like that is rarely the end of it. Whoever gets in doesn’t stop at the one page. He works his way sideways, through every application and all the data on the same server. If that server also hangs off the company network, this stops being a website problem. Now it’s a company problem.

I sit in front of a hacked box thinking: no. That’s not possible. It doesn’t work that way. And then, somewhere in the 3rd hour, once I’ve understood how the other guy was thinking, a voice in my head says: yes it can. That works. That works great.

For a second there I’m a fan. You don’t say that out loud in my line of work, but it’s the truth. Some of these attacks are beautiful. Lean, nested, with one move that only occurs to someone who understood the system better than the people who built it.

Then I look up who it was. And he’s 16.

That’s not a joke. A good share of what keeps you awake at night is built by people who aren’t old enough to vote. I know that pretty precisely, because I was one of them. While my classmates chased a ball around a field at 32 degrees Celsius, I sat inside and started to understand how the machine thinks. I never broke anything. I could have. That’s the whole point.

I take something away from every attack I reconstruct. You absorb the attacker’s brilliance whether you want to or not. These days I sit on the other side of the table. The way of thinking hasn’t changed. It just switched employers.

I use the same AI models, by the way, as the people who built your application. The difference is 42 years of seeing where those models get it wrong. And a review before anything goes live.

My head is an autobahn. 6 lanes, no speed limit, no exit.

That isn’t always pleasant. It’s also why you’re here.

I started at 14. An Amstrad, then a C64 with a freezer cartridge I built myself, then every Amiga there was, and a 20 MB hard drive the size of a printer. 20 MB is about 4 photos of the kind your phone takes today without thinking and forgets afterward. You got online through an acoustic coupler, the handset shoved into 2 rubber cups. If somebody downstairs picked up the phone, the connection was gone.

I’ve worked on systems every day since. No exceptions, including days when something else would have been smarter. I never learned these tools. I understood how they work, and that’s a difference you only notice once something is broken.

In 1998 I registered my first business and built websites. A single gigabyte of data transfer cost 300 marks back then. Your phone pulls down that much today without your noticing, and complains about the connection while it does. I worked worldwide from the start, back when a cloud still meant weather.

This isn’t a nostalgia paragraph. It’s why I see where a system will break before it breaks. If you know how it was built from the bottom, you’re the first to spot the cracks at the top.

I’m not an interchangeable service provider and I don’t want to be one. I’m a nerd in the full, uncompromising sense of the word. Where other people see noise, I see structure. A running machine, a seized hard drive, a mountain of code nobody wants to touch: for me they resolve into patterns. I don’t bend a finding to fit what somebody wants to hear, and I don’t call a system secure when it isn’t.

That’s why clients who found me over 25 years ago are still here. Not because of a price plan. Because they know they get the same answer no matter who’s asking.

The whole story

The one door that’s supposed to be open.

The fastest way to ask a first question with no obligation is Telegram. Telegram is operated by a provider in the United Arab Emirates. There is no adequacy decision for it under Art. 45 GDPR. For confidential or personal information, please use the contact form or email.

Anonymous first inquiries are welcome on any of these channels. I don’t ask who you are and I don’t require proof. In my previous line of work that was closer to standard. To answer you I technically need an email address. It doesn’t have to say anything about you.

Telegram: @intelligentpixel
Email: my@intelligent-pixel.com