Safaricom Plc’s popular payments platform M-Pesa offline, affecting mobile-money transfers, transactions, and payments.
I can’t recall when I last held cash (Kenya currency) in physical form in Nairobi until a few events happened today, then I remembered the importance.
I go to the gas station to refill and after the fuel tank is smiling, only to try making the payment and the payment couldn’t go through. I park on the side to wait and see if the MPesa App will be kind enough to allow the transaction go through (ha – no help)!
While at the gas station figuring out how to make the payment, my house manager calls: Auntie, gas is finished, I respond: call the provider to deliver the gas as soon as possible, after delivery is done, I try sending money, the Safaricom app keeps timing out, I do it a couple of time until when I receive a notification “You hakikisha service has been suspended for 48hrs” (this usually happens when several attempts were made to make payment but gets cancelled) which wasn’t the case this time around. The notification became suspicious.
tint ting… several text messages come in, from my banks alerting me “Dear Customer, we are experiencing intermittent MPesa service on Mobile Banking App“. Hours later, I try using my MPesa Global to send money, nah! not inaccessible
To check my socials, I log into X (twitter), only to find MPESA trending, still not clear. I sensed a DDoS attack to MPesa systems affecting mobile-money transfers and payments. So, Technically, this is a DDoS attack on MPesa.
How to identify a DDoS attack
The most obvious symptom of a DDoS attack is a site or service suddenly becoming slow or unavailable. But since a number of causes such a legitimate spike in traffic can create similar performance issues, further investigation is usually required. Traffic analytics tools can help you spot some of these telltale signs of a DDoS attack:
- Suspicious amounts of traffic originating from a single IP address or IP range
- A flood of traffic from users who share a single behavioral profile, such as device type, geolocation, or web browser version
- An unexplained surge in requests to a single page or endpoint
- Odd traffic patterns such as spikes at odd hours of the day or patterns that appear to be unnatural (e.g. a spike every 10 minutes)
There are other, more specific signs of DDoS attack that can vary depending on the type of attack.
What happens when a giant major service provider is offline?
