At least three South African web hosting and network providers have had services disrupted by large-scale distributed denial-of-service (DDoS) attacks since Monday, in a run of incidents that one provider has tied to a ransom demand – raising fears that the country’s internet infrastructure is being targeted in an extortion campaign.
Network Platforms, 1-Grid and Xneelo have all reported significant attacks over the past two days, with web hosting, e-mail and customer control-panel access disrupted across their networks.
The clearest sign of an extortion motive came from Network Platforms, which was hit on Monday afternoon. The provider said the attack began at about 1.25pm and escalated quickly, with inbound traffic peaking at well over 300Gbit/s. It described a small-payload UDP flood aimed at multiple IP addresses, with the attackers shifting targets across the network over time and striking both its IP transit service and clients’ networks.
Critically, Network Platforms said it received ransom demands – and that neither it nor the affected clients engaged with or paid them. For that reason, it warned, there remained “a strong possibility” of renewed activity. As a precaution, the company has switched on DDoS scrubbing protection for every client on its network, including those who had never subscribed to the service.
1-Grid, an SME-focused host formerly known as Gridhost, was also struck on Monday. The company, which says it serves more than 32 000 customers and hosts upwards of 77 000 websites, reported intermittent disruption from a large-scale attack on parts of its infrastructure, before later confirming the attack had been mitigated and full functionality restored with no customer action required. 1-Grid did not refer to any ransom demand.
Xneelo hit
The most recent provider to be affected is Xneelo, one of the country’s largest hosting companies and previously known as Hetzner. From early on Tuesday, Xneelo reported network degradation that left its control panel, the KonsoleH management system, web hosting and e-mail hosting intermittently inaccessible.
By late morning, it had confirmed a large-scale DDoS attack and said it was treating the matter as a priority incident, with its status updates still describing the situation as under investigation – an indication the attack had not been fully mitigated. TechCentral — which is hosted at Xneelo and which is experiencing intermitment issues with its website as a result — has reached out to the company for comment.
It is not yet clear whether the three incidents are the work of the same attackers, and only Network Platforms has publicly linked its attack to extortion. But the clustering of large-scale attacks on local hosting providers inside roughly 24 hours, alongside a confirmed ransom demand, fits the pattern of a ransom DDoS – or RDoS – campaign, in which attackers disrupt a target’s services and demand payment to make the disruption stop.
Hosting providers are attractive targets because a single successful attack can ripple across hundreds or thousands of downstream customers, amplifying both the disruption and the pressure to pay. DDoS extortion has become a recurring tactic globally, but a cluster of attacks on this scale against South African infrastructure in a single window is unusual.
For now, the disruption appears to be easing at two of the three providers. But South Africa’s hosting industry may be facing a continued threat. — (c) 2026 NewsCentral Media
Get breaking news from TechCentral on WhatsApp. Sign up here.