INTELLIGENT
piXel

Been hacked? I’ll get you out of it. Want to keep it from happening at all? Better still.

I secure servers before anyone gets in, and I reconstruct the case when someone does. I also build the software that runs on them. Since 1998, for companies, government agencies, and independent professionals, anywhere in the world.

Hardly any of my clients hear it from me that they’ve been hacked. They hear it from Google, from their hosting company, or from a customer who calls to ask why the company website is now selling erectile dysfunction pills.

If it’s already happened, order matters. The most common mistake after a break-in is a human one, not a technical one: you want it gone. So you delete. And what you delete is exactly the thing that was supposed to prove, 2 weeks later, that you weren’t negligent. Secure the evidence first, then close the hole, then clean up. I spent 25 years reconstructing how systems got compromised. The order is muscle memory.

If it hasn’t happened yet, you’re in the better position. Also the considerably cheaper one. Prevention, the way I do it, doesn’t mean installing a product and hoping. It means hardening and watching your systems closely enough that an attack shows up while it’s running, instead of when your host pulls the plug.

I don’t take every job. From the outside that makes me look hard to reach. My clients get the opposite: one contact who picks up the phone and knows their systems, because he built them. Some of them since 1998.

Write and tell me what’s going on. If I’m not the right person for it, I’ll say so. That’s rare, but it happens, and then the conversation costs you 20 minutes and nothing else.

Who’d bother attacking me, of all people?

It’s the question I hear most, and it’s completely fair. You have 14 employees, you sell dentures or ductwork, and nothing about your company screams intelligence service. So let’s do the math. Not by feel. By addresses.

The internet has 4,294,967,296 addresses. That’s not an estimate and not some industry figure. That’s 2 to the 32nd. The number has been fixed since the thing was built. Your company is one of them.

In 2013, 3 researchers at the University of Michigan released a tool called ZMap. It scans all 4.29 billion addresses. From a single machine, over an ordinary gigabit line, in under 45 minutes. That was 2013. Back when a gigabyte of storage still cost money.

45 minutes. Keep going. That’s 32 complete passes a day from one machine. Through the entire internet. Every day. And that’s one machine.

It isn’t one machine.

Your router in Starnberg, a NASA server, and the security camera at a gas station outside Rosenheim sit on the same list and get counted off in the same second. The scanner doesn’t know what NASA is. It knows that port 22 answered.

That answers your question, just not the way you asked it. Nobody decided on you. Nobody picked you out. Your number came up.

And you don’t have to take my word for it, because I keep count. Across my whole server fleet, an average of 20,000 serious attacks land every 24 hours. Serious means the background noise is already subtracted out. No harmless scans, no search engines, no misconfigured printers in Ohio. 20,000 attempts by somebody who wants something.

That’s one every 4.3 seconds. In the time it took you to read this section (about a minute), there were 14.

You’re not attacked because you’re interesting. You’re attacked because you’re reachable. That’s not a verdict on your company. That’s a loop.

What in that flood actually affects your systems today is in the Threat Log. Checked 4 times a day, judged by hand.

To the Threat Log

One company, one standard, one person to call.

Securing and running servers. Hardening, monitoring, early warning, and if you want it, the whole operation in EU data centers under my control. You call a human being, not a ticket system that informs you your request is important to them. My own system for this is called IPServerSec.

Websites running on WordPress. Repair after a break-in, migration to my infrastructure, updates and monitoring, plugins and themes.

Software. Apps for iOS and macOS, server systems, web applications, and the interfaces in between. Plus the infrastructure underneath: my own DNS server, my own mail server, every domain you need.

AI that actually goes into production. Systems, voice agents, and chatbots, hosted in the EU, wired into the tools you already use. Not a pilot project that never goes live. There are plenty of those lying around. Plus databases and vector databases, so your own material becomes searchable and not just your folder structure.

Forensics. Once it’s happened: what happened, how the other guy got in, what he did while he was inside, and how you prove it afterward. Because we got hacked is not documentation. It’s a feeling.

Advice for the people in front of the machines. Phone, laptop, the devices that carry half a life. The open door is rarely the server. Usually it’s the phone in your pocket.

Server protection I wrote myself.

IPServerSec is my own hardening and early-warning system for Linux servers. Not a plugin I bought, not a subscription. It grew over years out of real attacks on real servers. It runs on my entire server fleet and on my clients’ systems. I don’t test it on you. I test it on me, and the 20,000 from further up is the log of those tests.

It blocks, it detects, it alerts, and it logs. That last one is what everybody underestimates. When it counts, nobody asks whether you had a protection system. They ask whether you can prove it. The gap between those questions is roughly one insurance payout.

What happens to 20,000 attempts a day

They get sorted. Some get a few hours of blocking and are gone again. The second group is the interesting one: the same networks, over and over, for weeks, the same handwriting, often the same time of day. Mostly they belong to big providers overseas that rent out servers by the tens of thousands and evidently never get around to checking what’s actually running on them.

When the same attack comes out of one of those networks for the 3rd time, I don’t block the address. I block the network. For 10 years.

Is that proportionate? No. A global provider loses access to exactly one server in Starnberg. Nobody there will notice for the rest of the company’s existence. It bothers me surprisingly little. If you can’t get your own fleet under control, you don’t need to visit mine.

That’s the whole point: a rule set somebody writes for your server. Not a default a vendor wrote once for everyone and has been administering ever since.

So nothing comes off the rack. Every server gets its own rule set, built over 3 weeks from your real traffic, because a mail server needs different rules than a store, and a database server needs different ones than a VPN gateway.

What I don’t promise: absolute security. There’s no such thing. Anyone selling it to you is selling you something else.

IPServerSec in detail

Your website is up. That says nothing about whether it’s secure.

Roughly 4 in 10 websites worldwide run on WordPress. Which is exactly why automating attacks against it pays: find one hole and you’ve found millions of targets at once. Again, nothing personal, see above.

How fast that goes was documented in July 2026 by the German Federal Office for Information Security (BSI). Cybersecurity warning on WordPress, criticality level 3 of 4, 2 chained vulnerabilities, unauthenticated code execution. Publication and the first exploitation were one weekend apart.

The average installation is carrying add-ons somebody bolted on in 2019 to get a contact form, and nobody has touched them since. Neither has the developer, by the way.

I repair hacked installations, move them onto my infrastructure, keep them current, watch them, and lock them down with IPServerSec for WordPress. Where the stock parts aren’t enough, I write plugins and themes, and I’ll go into the parts of the code nobody else wants to touch.

You get the complete source code for everything I build for you. Anyone who locks you in by withholding your code hasn’t solved a problem. He’s created a second one.

WordPress

The best forgery I’ve ever seen came from a managing director who never wrote it.

A few days ago, an employee at a client of mine got an email. Sender: her managing director. Name correct, cell number in the signature correct, the layout an exact copy, down to the font size. It addressed her personally, by name. It asked for the current account balance.

It wasn’t the managing director. It was someone who had first pieced together who talks to whom inside that company, how people there write, and who answers whom without asking twice. I spent a quarter century as a court-appointed expert witness in digital forensics and I’ve seen hundreds of forged messages. This one was the best.

Your spam filter would have let it through too, because technically there was nothing wrong with it. No attachment, no poisoned link, no crooked sender address. Just one sentence meant to get somebody to do something. Anything that only looks for malware never finds this.

Where your mail sits today

A free mailbox isn’t a service somebody runs for you. It’s a shelf your mail gets put on. Nobody there knows your name, nobody checks, and when it matters, what you reach is a web form.

If you’re a physician and your practice mail sits with a free provider, that stops being a matter of taste. Health data is a special category under Art. 9 GDPR, professional confidentiality carries criminal liability in Germany under section 203 of the Criminal Code, and Art. 32 GDPR requires appropriate technical measures in so many words. The same goes for law firms, tax advisors, psychotherapists, and anyone with personnel files sitting in a mailbox.

I’m not a lawyer and this isn’t legal advice. But the question of who actually runs your mailbox, and who looks inside it, is one you will be asked when something goes wrong. Not by me, but by a supervisory authority, within 72 hours (Art. 33 GDPR).

vipmail

So I run my own mail server, in the EU, under my control. Every incoming message goes through several checks that are independent of one another.

It starts with the question of whether the sender is even allowed to be who he claims to be. SPF, DKIM, and DMARC are set up here for every domain and every account. No exceptions. That’s what makes your own mail arrive at the other end, and what makes forgeries in your name fall apart. Plenty of providers still don’t take that seriously. We do.

On top of that: public blocklists, for senders and for the addresses a message links to. Filtering software that scores the content. And a stage of our own, where a language model reads the message and judges whether it’s an attempt at fraud. That stage is what catches an attack like the one above, because it doesn’t look at the sender address, it looks at the intent in the text.

Since it’s a fair question, I’ll answer it before you ask: the language model never sees personal data. Names, addresses, phone numbers, account numbers, and file references are stripped out first. What gets judged is the structure and intent of a message, never the people in it. If that redaction fails even partly, the check is skipped entirely. We would rather let a message through unchecked than let content leave this house.

Underneath all of that sits the protection of the server itself. 8 separate sentries watch who tries to log in, at which service, how often, and how fast. 3 wrong tries and you’re out, automatically, in seconds. Above them sits IPServerSec, which blocks not just single addresses but entire network ranges belonging to providers that attacks keep coming from. Right now that’s 3,765 networks holding more than 306 million addresses that can no longer reach this mail server. The list grows daily.

Your data is backed up to 3 separate systems, hourly instead of daily. If something does happen, worst case you lose an hour, not a working day.

And then the part no software replaces: we read the logs by hand, every day. What got through, what got held, what should have been held, where a rule was too sharp. That’s how the system gets a little better every day. It’s the difference between a mailbox at a corporation and a mailbox here. There, nobody looks. Here, somebody looks every day, and he knows your name.

Why some senders fail here

We follow the rules that govern mail on the internet, strictly, and we enforce them. A server with no SPF, no DKIM, no DMARC, and no matching reverse DNS record doesn’t get in. Those gaps are exactly the opening forgeries come through: someone who can’t prove he’s allowed to send is indistinguishable from an attacker.

Nobody is left in the dark about it. The sender gets a reply in plain language stating what his server is missing and what his administrator has to fix. Anyone who fixes it can deliver again, not just to us but to Google and Microsoft, who have been asking for the same thing for years. We’re not strict. We’re just early.

The honest part

There is no such thing as complete security. Anyone who promises it is selling you something else. We’ve set the bar very high, and I’ll tell you where it ends: with you. A call to the number in your own address book, not the one in the signature, has already stopped a great many five-figure transfers.

Every mailbox here comes with two-factor sign-in. It costs nothing and takes 2 minutes to set up. Be clear about what someone else getting in really means: your mailbox is the master key to everything else. Almost every service lets you reset the password, and the link for it arrives by email.

Moving to us costs you nothing. MX records, DNS, exporting the old mailboxes, setting up your devices: we do that. Best case you notice none of it, except that from day one somebody is watching.

See vipmail

The most expensive code is the code that was easy to write.

A language model will write you a login form in 20 seconds. In the same 20 seconds it writes the hole in too. It doesn’t tell you, because it doesn’t know. Ask it afterward whether the code is secure. It’ll say yes. It always says yes.

It feels productive. It looks like it works. And almost every time, something comes out of it that none of the people involved can see.

What most people miss: one hole in an application like that is rarely the end of it. Whoever gets in doesn’t stop at the one page. He works his way sideways, through every application and all the data on the same server. If that server also hangs off the company network, this stops being a website problem. Now it’s a company problem.

I sit in front of a hacked box thinking: no. That’s not possible. It doesn’t work that way. And then, somewhere in the 3rd hour, once I’ve understood how the other guy was thinking, a voice in my head says: yes it can. That works. That works great.

For a second there I’m a fan. You don’t say that out loud in my line of work, but it’s the truth. Some of these attacks are beautiful. Lean, nested, with one move that only occurs to someone who understood the system better than the people who built it.

Then I look up who it was. And he’s 16.

That’s not a joke. A good share of what keeps you awake at night is built by people who aren’t old enough to vote. I know that pretty precisely, because I was one of them. While my classmates chased a ball around a field at 32 degrees Celsius, I sat inside and started to understand how the machine thinks. I never broke anything. I could have. That’s the whole point.

I take something away from every attack I reconstruct. You absorb the attacker’s brilliance whether you want to or not. These days I sit on the other side of the table. The way of thinking hasn’t changed. It just switched employers.

I use the same AI models, by the way, as the people who built your application. The difference is 42 years of seeing where those models get it wrong. And a review before anything goes live.

My head is an autobahn. 6 lanes, no speed limit, no exit.

That isn’t always pleasant. It’s also why you’re here.

I started at 14. An Amstrad, then a C64 with a freezer cartridge I built myself, then every Amiga there was, and a 20 MB hard drive the size of a printer. 20 MB is about 4 photos of the kind your phone takes today without thinking and forgets afterward. You got online through an acoustic coupler, the handset shoved into 2 rubber cups. If somebody downstairs picked up the phone, the connection was gone.

I’ve worked on systems every day since. No exceptions, including days when something else would have been smarter. I never learned these tools. I understood how they work, and that’s a difference you only notice once something is broken.

In 1998 I registered my first business and built websites. A single gigabyte of data transfer cost 300 marks back then. Your phone pulls down that much today without your noticing, and complains about the connection while it does. I worked worldwide from the start, back when a cloud still meant weather.

This isn’t a nostalgia paragraph. It’s why I see where a system will break before it breaks. If you know how it was built from the bottom, you’re the first to spot the cracks at the top.

I’m not an interchangeable service provider and I don’t want to be one. I’m a nerd in the full, uncompromising sense of the word. Where other people see noise, I see structure. A running machine, a seized hard drive, a mountain of code nobody wants to touch: for me they resolve into patterns. I don’t bend a finding to fit what somebody wants to hear, and I don’t call a system secure when it isn’t.

That’s why clients who found me over 25 years ago are still here. Not because of a price plan. Because they know they get the same answer no matter who’s asking.

The whole story

The one door that’s supposed to be open.

The fastest way to ask a first question with no obligation is Telegram. Telegram is operated by a provider in the United Arab Emirates. There is no adequacy decision for it under Art. 45 GDPR. For confidential or personal information, please use the contact form or email.

Anonymous first inquiries are welcome on any of these channels. I don’t ask who you are and I don’t require proof. In my previous line of work that was closer to standard. To answer you I technically need an email address. It doesn’t have to say anything about you.

Telegram: @intelligentpixel
Email: my@intelligent-pixel.com