Who’s Knocking on Our Door? A Plain-English Look at the Attacks on Our Website

Think of our website like a store. Most people walk in to shop. But some visitors are robots trying to pick the lock, copy the shelves, or sneak out with the cash register. Here is what kind of attacks we blocked:

A bot is a computer program that visits websites by itself. Some bots are helpful. Others come to copy, snoop or break in.

Most of these bots do not live in someone’s basement. They run on rented cloud computers. Anyone can rent one for a few dollars, attack with it, then throw it away and rent another.

We blocked 819 password-guessing attacks in 30 days, and 289 in the last week alone. A brute force attack is like a robot trying every key on a giant key ring until one opens the door. It never gets tired.

A smarter version is called credential stuffing. Here is how it works:

1. Some other website gets hacked.
2. Stolen emails and passwords get sold online.
3. Robots try those same pairs on our login page.
4. We spot the pattern and block them.

What it looked like for us

1. Sep 9 to Oct 6

   One attacker rented at least 11 cloud computers, one after another, to hammer our login page. One range alone was blocked 173 times.

   Blocked each cloud range as it showed up
2. Sep 26 to Oct 5

   Robots from at least 7 different addresses tried an old staff email we had already retired.

   That email is now a trap. Anyone who tries it is blocked forever
3. Sep 28

   A robot tried guessing logins using the owner’s name.

   Blocked the whole network it came from

Not every attack is a robot. On Tuesday night, one very determined human picked a fight with our store. It did not go well for him.

We believe him. Busy, happy grown-ups do not spend Tuesday night placing fake orders on a peptide store. A manchild who is unhappy with his own life and needs someone to blame does.

A little bitch with no purpose or conduct in his life, trying to hide behind a keyboard.

Total cost to us: one order we never shipped, and a good laugh. To our dedicated fan: you put in more effort than most of our robots. We hope you find a better hobby. Knitting is nice.

Some peptide sellers spend more energy fighting each other than testing their products. They send bots at rival stores, post fake reviews, copy each other’s lab reports, and play tricks with Google.

The most common trick is a PBN, short for private blog network. A seller buys a pile of old, dead websites, fills them with quick blog posts, and points every post at their store so Google thinks lots of people recommend it.

This is called black hat SEO, meaning cheating to rank higher on Google. Google calls it spam and has been punishing sites that use PBNs since 2014. Why should you care? Because you are the one clicking those links.

Canadians lost at least $704 million to fraud in 2025, and fewer than 1 in 10 frauds even get reported (Investment Executive). In the peptide world, watch for the boom-and-bust store:

Even big, well-known vendors can disappear. One large U.S. peptide seller shut down suddenly in March 2026 with no timeline for open orders (Peptide Protocol Wiki). If that happens to your supplier, our guide on switching suppliers safely walks you through it.

The money is only half of it. A store that cuts corners on security also leaks what you typed in: your name, address, email and phone. Crooks use that to send fake “your order is delayed” texts, or try your password on other sites.

Red flags to watch for

• No lab reports, or reports that do not match your batch
• “70% off, today only” sales that never end
• No real way to reach a person
• A brand-new site you suddenly see everywhere
• Payment only by gift card
• Orders stuck on “processing” for weeks

What happens to our little store is a tiny copy of what happens to big tech companies every day. A DDoS attack is when millions of robots rush a website at once, like a crowd jamming a store door so real shoppers cannot get in. Cloudflare sees about 5,343 of these network attacks every hour, and the giant ones just exploded:

Every visitor passes five checks before they reach your account, like layers around a castle:

1. The moatCloudflareStops lots of robot traffic before it reaches us.
2. The wallFirewallChecks every visitor against a live list of bad addresses.
3. The doorLogin lockLocks out guessers. Old logins become traps.
4. Speed limitRate limitsRobots grabbing pages too fast get blocked.
5. The guardA real personReads our security logs every day.

Your 5-step safety checklist

1. Use a different password on every website. A password manager makes this easy.
2. Check that the web address is spelled right before you log in or pay.
3. Never click a link in a text or email about your order. Go to the website yourself.
4. Ask for lab reports, and check that the batch number matches what you bought. Ours are on our Lab Testing & COAs page.
5. If a deal looks too good to be true, it usually is.

The robots will keep knocking. We will keep the door locked.