South African web hosting companies rarely make headlines for the wrong reasons. Last week, several of them had no choice.
A wave of distributed denial-of-service attacks tore through multiple providers within days, knocking websites, email services, and cloud systems offline across the country. The targets included 1-Grid, Host Africa, Domains.co.za, Liquid Intelligent Technologies, Network Platforms, and cloud backup provider Datakeepers.
The numbers are hard to ignore. The attack on Host Africa reportedly peaked at 1 terabit per second. Domains.co.za absorbed roughly 100 gigabits per second. Liquid was still under active attack when reports first surfaced, having already shut down UDP traffic at 90 gigabits per second just to keep its network breathing.
What made these attacks unusual was the method. Rather than hammering a single IP address, attackers used carpet bombing, spreading traffic across entire IP ranges to overwhelm providers at scale. They paired this with IP fragmentation and DNS amplification, two techniques that exploit how the internet’s core protocols work. Together, they let attackers punch far above their weight.
Host Africa CEO Michael Osterloh said his team contained the attack within four hours and has since started upgrading infrastructure. He noted something that should concern the broader industry: attacks at this scale are new, but the rising frequency is not.
“We have not seen attacks with this magnitude before, but we have seen a noticeable rise in the frequency of these attacks as they become easier to access,” Osterloh told MyBroadband.
That last part matters. DDoS tools have grown cheaper and more accessible over time, and South Africa appears to be feeling that shift in real time.
1-Grid confirmed its attack occurred on 17 May and said services were restored with help from upstream network partners. For at least one customer, though, email had been down for a full week before the company publicly acknowledged the incident.
No group has claimed responsibility.
