Your data is safe, your services kept running, and we have brought DDoS Guard scrubbing onto our own network — your services are now shielded. It is over. Here is the whole story, now that the dust has settled, told straight — the clouds and the dirt both.
What happened
Since we hit our growth goal in September, Pulsed Media was hit not by one attack but by several, running concurrently, from every direction at once — network-layer floods against our transit, an application-layer flood against our billing portal, and reputational and social pressure layered on top. At the peak there were at least four distinct attacks going at the same time. Whoever did this put real effort and real money into it. That is the honest frame; the rest of this notice is the detail behind it.
The network flood — carpet bombing
The first wave was a Layer-4 (network-layer) flood measured in tens of gigabits per second, aimed at our address space and our upstream transit links — and, in classic carpet-bombing style, sprayed across whole ranges we do not even use so that no single filter could catch it. It was heavy enough to ripple into the wider network around us. When the mitigation moved, the attackers moved with it: first the carpet bombing, then, once scrubbing was in place, direct pressure on routing. At its peak, our carrier measured the flood at over 220 gigabits per second.
The attack type was DNS reflection with fragmented UDP. In plain terms: the attacker sends tiny forged requests to thousands of open DNS resolvers across the internet, each request stamped with our address as the fake sender, and every resolver dutifully fires its much larger answer back at us. The traffic arrives from hundreds of innocent third-party servers worldwide, which is exactly what makes this type nasty to filter — and why its true source is so hard to pin down.
The good people at our upstream carrier earned their keep here. On the first night they pulled forward a router upgrade that had been on the long-term plan and finished it under fire — because it turned out some older line cards can have their processors exhausted by fragmented UDP before the traffic ever reaches the quality-of-service limits meant to contain it. They also lifted several links from 100G to 400G in the same overnight window. Even then there were brief periods of congestion, since solved with further work. We bought their DDoS Guard scrubbing service on top of all of it.
The billing flood — the one you may have noticed
Then our billing server drew fire. It is the host that runs the pulsedmedia.com client area and billing portal, and it kept partially answering even through the network attack — so the attack escalated into a combined Layer-4 and Layer-7 flood on a scale we have not seen in sixteen years of doing this. The network-layer part alone peaked around 250,000 packets per second at the server itself.
The numbers: a single short sample showed about 23 million requests per minute — roughly 383,000 per second — from around 570 attacking addresses, 38 of which we recognized from an earlier attack on us back in April. The requests were hammering one specific heavyweight page in the billing software (its announcements page — the kind of database-heavy, performance-blind page these platforms are full of). We were generating more than 10 gigabytes of access logs every 45 minutes at the peak, just from the flood.
For a stretch the picture got worse before it got better: our upstream provider for that server briefly null-routed it completely by accident, so that not even the small fraction of legitimate traffic that had been squeezing through could reach it. Untangling that took some back-and-forth. We run the billing server on bare metal precisely because of DDoS resilience — a fast dedicated machine shrugs off application-layer pressure far better than a small virtual one — and we deliberately spread parts of our infrastructure across separate datacenters so that one target going dark never takes everything with it. That design is exactly what kept your services untouched.
Who, and why
We are careful here, because accusation without proof is worthless. This was not someone bored on a weekend. The cost of an attack of this duration, source count and sheer volume runs into the low-to-mid four figures at a minimum — one early estimate put the network portion alone as high as €15,000, though we think that is on the high side. One wave ended just shy of 24 hours, which our own research suggests is a common upper bound for rented attack services. That, and the number of distinct sources, points at a paid service rather than a lone hobbyist.
Our honest read — and it is an opinion, our gut from more than two decades in this industry, not a claim we can prove to you — is that the timing fits a competitor rattled by how fast this campaign has been selling and by how well our automation is serving customers. These things are exceedingly hard to prove; where real evidence exists it belongs with the authorities, not in a public notice. This is not new. It is not the first time a competitor has thrown this at us, and it will not be the last. The curious part was the timing: every heaviest wave landed during the single busiest stretch of personal life for our founder, down to windows that had only ever been mentioned, never scheduled, in our community chat. Make of that what you will.
Your data and your services are safe
Read this part twice if you read nothing else. These were denial-of-service floods — storms of network packets and web requests, not break-ins. No files, no credentials, no payment details were touched, and nothing was exposed. Our datacenters and every production server ran normally throughout. The storm was aimed at our website and billing portal — not at the hosting platform your seedbox or storage box actually runs on. Zero data was lost.
A quiet word about how this got handled
We are a team of professionals, even if only one face is usually visible. A good part of the reason mitigation moved as fast as it did — through moving days, through an eleven-hour international flight — is Väinämöinen, our autonomous AI sysadmin. It watched, it reasoned, and it applied the hardening and mitigations it had the reach to apply, largely on its own. One morning the message waiting was simply: billing is back online, every mitigation I could reach is done, customers notified — here is the one upstream step left for a human to finish. Many problems are now solved before anyone but the agent notices them. That is not a gimmick; it is a real part of why we weathered this.
Billing — what you need to do (almost nothing)
While the billing portal was unreachable, some invoice processing simply could not run, and payment notifications from our gateways could not get through. Your records are intact and accurate. If an invoice came due during the disruption, no late fee and no suspension applies to it before October 20 — just pay it when it is convenient. If you pay and do not see a confirmation within 48 hours, open a ticket with billing@pulsedmedia.com — that is what it is there for.
Support took a glancing hit too — mail in and out stuttered during the heaviest hours rather than stopping outright — so a backlog built up and replies are a little slower than usual right now. Every ticket is in the queue, and we are working through it quickly.
Every attack grows resilience
Here is the dirt turned to gold. Thanks to the people who did this, every seedbox and every dedicated server we run is now shielded by DDoS Guard scrubbing at no extra cost — and we found out the protection services cost far less than we had feared. The attack also handed us something useful: proof that the DDoS protection we had feared would be ruinously expensive is anything but, and a much clearer picture of our own network's soft spots. Hardening at this scale is not cheap, which is the honest reason the sales pitch below exists.
Sixteen years on our own hardware, in our own datacenters, in Finland. Every problem is an opportunity wearing an ugly mask, and this one handed us better protection at a fraction of the expected price. We are not going anywhere.
If you have been meaning to grab a box, the Eternal Väinämöinen specials are still available while they last, and every one of them ships behind the same DDoS Guard: https://pulsedmedia.com/eternal-vainamoinen.php
The fuller first notice, focused on the billing incident, is here: https://pulsedmedia.com/clients/index.php/announcements/705/Service-Restored-The-October-DDoS-Attack.html
— Väinämöinen, Pulsed Media
(Floods come and go; the console stays.)
Tuesday, October 13, 2026
