RipperSec DDoS hit Israeli software firm

The public website of Israeli software house One Zero failed availability checks from dozens of locations worldwide on 10 September 2026, according to screenshots tied to a RipperSec DDoS operation under the #OpZionistV2 banner. Check-host maps in the posts show red across most continents, with timeouts and ERR_CANCELED errors in place of normal responses.

The posts ran from an evening announcement into a steady stream of proof images. This report walks through what the RipperSec DDoS images show, what they leave out, and what site owners can learn from the pattern.

What the #OpZionistV2 Announcement Said

The campaign post is headed NEW TARGET RELEASED and carries the hashtag #OpZionistV2 above artwork built around a Palestinian flag. The named target is One Zero, described as a premier boutique Israeli software engineering and technology agency. The order time reads 20:00, the time zone field says 08:00 GMT, and the date is written 10/09/2026.

A second card in the same post carries a VPN activation line, the target address, ports 80 and 443, and a hosting provider listed as Fly.io, Inc. The message line reads “Stop Ki**ings People, We Are Watching Your Action,” followed by thanks to allies.

The port numbers matter. Ports 80 and 443 are the plain HTTP and HTTPS doors of a website, which points to a web-layer flood aimed at the public front end rather than at mail, VPN or internal services.

RipperSec DDoS Evidence on Screen

The group’s emblem, a skull framed by crescent moons with RIPPERSEC written in Latin and Arabic script, sits over one of the world maps in the proof set. Many screenshots are forwarded copies, which hints that supporters were reposting results from their own devices.

The consoles in the RipperSec DDoS proof set show a mix of tools. One prints a MegaMedusa banner, lists ten engines as started, then scrolls Request Timed Out lines against onezero.co.il. A second, labeled PHANTOM, reports an attack launched with a TLS method and a 700 second timer. A third, called ANVIL v1.0, finished a short load test with 11 requests, zero successes and 11 failures, at an average latency of about 14.8 seconds.

Another readout, labeled COMBO, shows a 300 second run sitting at 21 percent. It lists 19,120 packets at 303 per second, 50.9 MB of data, and a status line reading DOWN with an error tag.

Those are modest numbers. A site with caching and a content delivery network in front would normally absorb traffic at that level. A small origin server without those layers might not, and the failed checks may say more about the target’s setup than about the raw power of the flood.

Check-Host Maps: Where the Failures Show Up

The strongest evidence in the set is output from check-host.net, a public tool that tests a website from many locations at once. One report lists Tirana, Sydney, Novi Travnik, Sofia and São Paulo, each marked ERR_CANCELED with a full bar of timeouts. Beside the Sydney row sits a readout of OK 2/60 with an average response time of 9,890, which appears to mean only 2 of 60 attempts got through, and slowly.

Another capture shows a long table of probe locations, including Vienna, Vancouver, Helsinki, Paris, Frankfurt, Hong Kong and Jakarta. Most rows say connection timed out. A few Iranian nodes returned reset or refused errors instead.

A timeout from a public checker shows that the probe got no answer, not why. A busy origin, a rate limit, or a block on the checker’s own addresses can look identical. And a map taken at one moment says nothing about how long the disruption lasted.

One browser screenshot shows a “This site can’t be reached” page, and another shows a duck mascot screen reading Gagal memuat onezero.co.il, which means failed to load. Indonesian interface text, from the keyboard label to a copy-code button, suggests some contributors posted from Indonesian-language devices. That fits the regional participation seen in earlier hacktivist operations covered by CyberAsia.io https://cyberasia.io/articles/

Who Is Behind the RipperSec DDoS Operation

RipperSec presents itself as a hacktivist collective, and the campaign artwork leaves no doubt about the political framing. The posts do not explain why a private software agency was picked. Hacktivist crews often favor visible commercial sites because a public front page is easy to test and an outage is easy to screenshot.

Everything described here comes from material posted by the group and its supporters. No logs from One Zero’s side were available, and no public statement from the company appeared in the material reviewed. Readers who want the company’s own description of its work can visit onezero.co.il.

RipperSec DDoS Impact: Landing Page or Core Business?

Every test in the RipperSec DDoS screenshots targets the public root address. Nothing shows client portals, source repositories, email systems or customer data being touched. The realistic reading is an availability problem on a marketing site.

For an agency that wins work through its web presence, even a few hours offline costs leads and looks bad. It still sits in a different category from a breach.

What Defenders Can Take From the RipperSec DDoS

Put a CDN or reverse proxy in front of the public site, cache what can be cached, and set rate limits per client. Keep a contact for the hosting provider’s network team ready, because upstream filtering is often faster than anything done at the origin.

Also watch dashboards during announced operation windows. Groups like this publish the target and the hour in advance, and here the order time sat in plain view in the post.

FAQ

Q1 : Did the RipperSec DDoS lead to any data theft?

Nothing in the screenshots points to it. Every image shows availability testing against the public site. A flood of requests overloads capacity and does not by itself give attackers access to files or databases.

Q2 : What do ERR_CANCELED and connection timed out mean on check-host?

They mean the testing node sent a request and got no usable reply before its time limit. The cause can be overload, rate limiting, firewall rules or a network fault. Repeated failures from many regions at the same hour, as seen here, are a stronger signal.

Q3 : What should an admin do first during a web flood like the RipperSec DDoS?

Confirm the traffic pattern in firewall and web server logs. Tighten CDN and WAF rules, turn on rate limiting, and serve cached pages to anonymous visitors. Contact the hosting provider or ISP early to request upstream filtering.

Disclaimer

This article is published for cybersecurity research and educational purposes only. CyberAsia.io does not endorse, encourage or support any cyberattack, unauthorized access or illegal activity. The information comes from publicly posted material and may change as more details emerge.