RipperSec DDoS Hits Max.co.il: Critical 0/56 Node Report

The latest RipperSec DDoS campaign pushed the public website of Israeli card issuer MAX IT Finance Ltd into error pages on Monday, September 14, 2026. Max, formerly known as Leumi Card, appeared on the group’s #OpZionistV2 target list with a start time of 15:00. Screenshots posted by the group show 429 Too Many Requests errors, a fallback notice hosted on a googleapis.com address, and public check-host reports where most probe locations failed to load www.max.co.il.

Max has not published an incident statement in any material seen by CyberAsia, so the real customer impact is not known. The screenshots show a familiar routine: announce a target, run a flood, then circulate probe results as public proof.

RipperSec DDoS Timeline: How the Max.co.il Attack Unfolded

The announcement carries a 14:01 timestamp, with banner artwork branded #OpZionist V2 and a header reading NEW TARGET RELEASED. It lists MAX IT Finance Ltd as the target and describes it as one of Israel’s leading credit card companies. The order time was 15:00 on 14/09/2026, with the time zone field reading 08:00 GMT.

A second post served as the technical brief. It named www.max.co.il, listed four IP addresses, gave ports 80 and 443, and identified Amazon as the hosting provider. CyberAsia has withheld the addresses, the message field and the names of forwarding sources.

More posts followed through the afternoon. At 15:18 the group shared two browser screenshots and a check-host.net report. More check-host material appeared at 15:30 and between 15:44 and 15:53, alongside a FREE PALESTINE message. The last posts, at 16:34 and 16:36, circled an Israeli probe location and added the words Good job, soldier. View counts stayed between 18 and 52, so the audience looked small.

Who Is RipperSec and What Is #OpZionistV2?

Public threat intelligence profiles describe RipperSec as a pro-Palestinian hacktivist group and emerged in June 2023. Cyble’s profile credits it with close to 200 DDoS attacks, many aimed at Israeli government and private sector websites. Radware has separately written about MegaMedusa, a public web DDoS tool linked to the group. The screenshots here do not name the tool used against Max.

The V2 in #OpZionistV2 suggests a second round of an earlier operation, though this material does not show the first.

https://cyberasia.io/actor/rippersec/: CyberAsia.io coverage of earlier RipperSec DDoS operations.

What the Screenshots Show About the Max.co.il Outage

The 429 page, the fallback notice and the first report

Figure 3 combines two browser captures. The first sits on a googleapis.com address and says the site cannot display information right now, then lists urgent options for visitors abroad: a voice line for a secret code, a 24/7 contact for lost or stolen cards, and WhatsApp. The second shows max.co.il returning 429 Too Many Requests, with a RipperSec logo laid over the page. That overlay is the group’s own branding, so the image works as publicity material and not as an independent log.

A 429 is a rate limiting response, which usually means a protective layer is throttling traffic. It is not the same as a collapsed server. The check-host.net report in the same post is mixed. Finland and Germany returned 200 OK after roughly 13 to 25 seconds, Hong Kong returned 502 Bad Gateway, both Jakarta probes got 303 redirects in about 1.3 seconds, and Iranian probes failed with timeouts, refusals and a reset connection.

The 0 of 56 result and the 403 detail

The check-host.cc map in Figure 4 is the strongest visual. Dated September 14, 2026, it shows HTTP 0/56 nodes up, with most continents in red. A bot output forwarded with a GOJO label lists the target as DOWN with a 403 code, plus 3 successful checks, 27 failures and 9 blocked. A 403 is a refusal, not a timeout, so it can mean an edge filter was rejecting automated probes. Another check in the same screenshot shows 200 responses taking about 13 to 17 seconds, which describes a degraded site, not a dead one.

Netanya, Sydney and the limits of probe data

Figure 5 shows a check-host table where the group circled Israel, Netanya as Connection timed out. The line just below, Tel Aviv, still reads OK. The second report shows a mostly red map, a Tirana probe ending in ERR_CANCELED, and a Sydney probe with a 502 and 0 of 24 successful checks.

Taken together, the evidence supports degraded or restricted access from many locations on the afternoon of September 14. It does not show a full shutdown of card services, the mobile app or payment processing. Some Israeli sites also limit foreign traffic, so certain country-level failures may predate the attack.

Defense Notes for Financial Sites Facing a RipperSec DDoS

Layer 7 floods aimed at ports 80 and 443 are best absorbed before traffic reaches the origin. Teams at card issuers and banks can take four steps:

• Put a CDN or scrubbing service in front of every public hostname, with rate limits and bot challenges.
• Host a fallback notice and status page on separate infrastructure.
• Split the marketing site from login, app APIs and payment endpoints.
• Monitor from several regions and compare 429, 502 and 403 patterns before calling an outage.

FAQ

Q1 : Was customer card data stolen in the Max.co.il attack?

Nothing in the screenshots points to data theft. A DDoS floods a site with requests and does not by itself expose records. Customers should still distrust unexpected texts or emails about card problems, since scammers often use outage news as cover.

Q2 : Was Max.co.il really offline everywhere?

The evidence says no. One report shows 0 of 56 nodes up, yet other probes returned 200 and 303 responses, and Tel Aviv read OK in the circled table. Slow pages, rate limiting and filtered probes can all look like downtime on a public checker.

Q3 : What should an IT admin do first during a flood like this?

Contact the CDN or hosting provider, switch on rate limiting and challenge rules for the targeted paths, and keep full request logs. Then publish a plain status message so customers know which services still work.

Research Notice

This article is published for cybersecurity research and educational purposes only. CyberAsia.io does not endorse or encourage any cyberattack or unlawful activity. The information comes from screenshots and public posts, and sensitive details such as IP addresses have been withheld. Readers must not attempt to access, test or disrupt any system named here.