Timeline
– – – – 07-05-2022 – – – – –
22:22
Number and intensity visibly decreases. However, it has been decided to keep the defense high if it is intensified again. If it is the case that you are not allowed to go to the login screen because your IP address has been blocked by cloudflare, please contact customer service by e-mail.
17:50
Quiet morning and afternoon. Intensity of the attacks decreases. Probably because there are now many millions of IP addresses worldwide blocked that were used by the botnet. Fewer and fewer attacks are coming through. Our servers are not bothered by this and can handle this perfectly. By setting a few defensive measures differently, we can now also upload scans for PriPost and photos of PriParcel. Customers can also upload IDs again.
13:45
The login screens on the websites appear to work insufficiently due to the attack. That is why we have (temporarily) chosen new customers, by means of a new tab, to make the registration possible directly in the portal.
08:40
Throughout the night there have been attacks on both the portal and the website. However, these have decreased in effectiveness. However, various defensive measures remain in force. For example, visitors to both the portal and the websites see a control screen of cloudflare for a number of seconds.
– – – – 06-05-2022 – – – – –
17:40
We still continue to get attacks on both websites and the portal. The impact is reasonably limited. However, it is not possible to upload PriParcel photos and PriPost Scans at the moment. We have also had to block entire countries. The attacks now come from 114 countries. We have also seen that there are different IP addresses of our own customers that are in the botnet. This means that the computers of those customers are used by the attackers. Those IP addresses cannot be released. It’s likely that those customers don’t know their computer is being used. Malware is quickly installed by a click in the wrong mail. A warning to use good security software!
Visitors to the websites and portal are shown a cloud-flare security page for a few seconds with which the visitor is validated. As soon as peace has returned, this will disappear again.
For now, there’s not much we can do but wait and see. Our IT staff will also remain on standby during the weekend and monitor the case. The administration, mail and parcel processing are not yet delayed.
12:30
During the day, the attacks continued, but about 300,000 IP addresses per minute were captured. At 15:13 we received a new message from the attackers that if we did not pay, our websites would be attacked. Less than a minute later, all our websites went down.
The attacks still continue and visitors suffer a lot from the measures and slowness. We will continue to monitor and report this.
– – – – 05-05-2022 – – – – –
09:15
Situation unchanged
08:15
Portal is accessible but may be that some foreign users cannot log in because their IP address is blocked. When logging in and visiting the portal, a cloudflare page can become visible that performs a check on the user. This takes a fraction of a second after which the visitor is redirected
05:15
Attack continues unabated
04:15
Situation unchanged – defensive actions prove effective but slows down the portal
03:15
Situation unchanged
02:15
New attack has started. Now from several countries including Brazil, Peru, Morocco
01:15
traffic is increasing again. Defensive measures are deployed
– – – – 04-05-2022 – – – – –
23:17
Our CEO explains further in a blog post. Read the text here
21:00
No further updates. Traffic seems quiet.
19:45
IT team remains ready and monitor everything. Some customers may have trouble logging in due to the IP whistelisting. Contact customer service in the morning is the advice.
19:15
New attack but is repulsed and immediately neutralized.
18:00
Portal still live but can be slower due to the amount of traffic.
17:25
Attackers are definitively located and have a Russian origin. Entire IP ranges are blocked
17:20
Attackers continue to follow us and continue to attack. Portal is live and attackers are not getting a foothold.
17:16
New layer of protection against DDos attacks implemented.
17:15
New server set up and running. DNS modified
16:49
Attack continues. There is currently no solution yet.
15:20
Our IT is busy neutralizing the attack. For the time being, our websites are not affected by the attack
15:20
Server goes down. Turns out a DDoS attack is being carried out.
15:19
Through the chat we receive a threat from a Russian IP address that we immediately have to transfer a large amount of money to prevent a DDoS attack on the PriPortal. Of course, we don not respond to this.
