qocial

We have proof of our investigation, and we are only sharing while being 100% sure of what data we have received from Attackers on our end while they were attempting to find the available mail by sending email contents to multiple email addresses.

Yes ( except what we missed was throttling requests )

We have PRO plan in our Frontend serving requests and are running on Enterprise plan on few of our backend endpoint. We have not yet fully implemented Enterprise plan for our backend due to CORS issue, we will be resolving them today and getting that applied too.

Thanks

Our validations are not the issue, they are correctly working for forms. We had no limit set per user. We have just started throttling user's request based on their activity. We are still working on it and performing all app related updates.

Outside app, we are not sure, what else can be done. We are already using PRO membership of cloudflare, but I don't think cloudflare are working correctly. requests in cloudflare is not matching with the request in nginx reverse proxy log.

They are spamming our services; we do see a couple of security testing codes made to our infrastructure by those spammers, but they are all invalid, so we are not impacted by them.

But our concern is: we missed throttling, so they are DDOSing to our services; it has not impacted us on performance, but user experience. We are currently working on adding throttling now. We are monitoring our Logs to find out attacks we been receiving and mitigating them.

Beyond this, we are still determining what other actions can be taken and looking for feedbacks.

Those spammers have also targeted our Email account. We got the first possible name of the attackers as "Junaid Raza."