RipperSec DDoS Attack Hits Israeli Retailer BUG: 522 Errors

A RipperSec DDoS attack pushed the public website of Israeli electronics retailer BUG into Cloudflare error 522, “Connection timed out,” according to screenshots from an operation the group scheduled for 20:00 on September 15, 2026. Check-host reports posted under the group’s #OpZionistV2 banner show timeouts and HTTP 503 responses from probe nodes including Tirana, Sydney and Sofia.

RipperSec describes BUG as Israel’s largest retail chain for computers and consumer electronics. That description comes from the group’s own post, and no statement from BUG or Israeli authorities had been located at the time of writing.

This report sticks to what the five screenshots show and marks what remains unconfirmed.

How the RipperSec DDoS Attack Was Announced

The first post is a forwarded message from a channel handle, RipperSecDirect. It carries an #OpZionistV2 banner, a “NEW TARGET RELEASED” header and a short target card. The target name is BUG. The order time reads 20:00, the time zone field reads 08:00GMT, and the date reads 15/09/2026. The card then lists https://www.bug.co.il/ as the address and adds a reminder to activate a VPN.

The message line says “Stop Ki**ings People, We Are Watching Your Action,” and the post ends by thanking allies.

A fixed start time and a VPN reminder fit a crowd-driven format. Public profiles say each RipperSec DDoS attack leans on follower participation, not on a large private botnet.

Error 522 and HTTP 503: What the Evidence Shows

The left post pairs a Cloudflare error page for www.bug.co.il, error code 522, with a capture of the shop’s Hebrew storefront and an “All United for Free Palestine” graphic. Its caption adds a check-host report link.

The right post is a world map chart with a terminal capture on top, linked to a check-host.cc report. Three rows are visible. Tirana, Sydney and Sofia each show HTTP 503 with 0 of 60 requests answered successfully. Average response times are 9,298 ms, 6,406 ms and 5,192 ms, with peaks above 14,000 ms.

Error 522 is specific to Cloudflare. It means the edge network accepted the visitor’s request but the origin server did not complete a connection in time, which points at pressure on the origin and not a loss of the CDN itself. Cloudflare documents the code in its error 522 guide. A 503 means the service could not handle the request. Together they fit an overload during the RipperSec DDoS attack, though neither names the cause on its own.

Attack Tool Output and the Proof Trail

The next batch of posts in the RipperSec DDoS attack thread, time-stamped 19:37 to 20:27, moves from site errors to the operators’ own consoles. One terminal capture lists requests to WordPress paths on bug.co.il, including xmlrpc.php, wp-login.php and wp-json routes, with several [429] responses. A 429 means too many requests, so at least part of the site was rate limiting the traffic.

Another capture shows an “attack launched” banner naming a TLS method and a 120-second run, followed by log lines marked HTTP FAIL (TIMEOUT) at 5000 ms. A third console lists the target URL and request counters. Two check-host tables list resolved addresses in ranges commonly used by Cloudflare, which fits the 522 page.

Seven report links appear across the screenshots, six of them time-stamped between 19:36 and 20:28. CyberAsia.io does not reproduce tool names or settings.

Site Messages and the Closing Post

The final screenshots add two views from the target’s side. A browser capture shows “This site can’t be reached” for www.bug.co.il beside another check-host table and a Go-based request tool log showing tens of thousands of requests sent.

The last post, at 20:41, shows bug.co.il in a mobile browser with a plain notice that the website is experiencing a problem and will be back soon. The caption praises “all RipperSec soldiers.”

A notice like that can come from the retailer itself, for example after switching on a protection mode. It shows the site was unavailable to that visitor at that moment, not how long the disruption lasted. No recovery time for the RipperSec DDoS attack appears anywhere in the material.

About RipperSec

The logo is a black circular badge with a white skull framed by crescent moons, and the name RipperSec in Latin and Arabic script. Cyble’s threat actor profile describes the group as pro-Palestinian, active since June 2023 and responsible for nearly 200 DDoS attacks, many aimed at Israeli government and private sector sites. Cyble also links it to a public attack tool called MegaMedusa.

The consoles in this campaign carry other banners, so the screenshots do not show which tool generated the traffic in this RipperSec DDoS attack.

What This Means for Retail Sites

BUG is a storefront target, not a government one. A RipperSec DDoS attack on a retail domain hits browsing, ordering and support pages first, while physical branches keep trading. The posts show website symptoms only. They do not mention payment systems, customer records or branch operations, and nothing in them points to stolen data.

Defensive Steps for E-Commerce Teams

Retail teams can blunt a RipperSec DDoS attack like this one with a short list of controls:

• Accept origin traffic only from the CDN’s published address ranges, so requests cannot bypass the edge.
• Rate limit costly endpoints such as login, search and API routes, and disable XML-RPC on WordPress sites that do not use it.
• Cache at the edge and keep a static fallback page ready for incidents.
• Turn on bot challenges and firewall rules before a campaign window, since orders like this one are announced in advance.
• Monitor from several regions and keep CDN and ISP escalation contacts at hand.

More on this pattern: https://cyberasia.io/articles/: related CyberAsia.io coverage of hacktivist DDoS campaigns.

FAQ

Q1 : What does Cloudflare error 522 mean for a visitor?

The connection between Cloudflare and the site’s origin server timed out. The CDN is answering, but the origin is not. Overload, a firewall rule or a server outage can all produce it, so the code alone does not prove an attack.

Q2 : Was customer data stolen in the RipperSec DDoS attack on BUG?

Nothing in the screenshots shows stolen data. The posts describe traffic floods and error pages, and no findings from BUG could be located. Customers should still watch for phishing messages that reuse the news.

Q3 : Could shoppers still use BUG stores?

The posts concern the website only. They give no sign that branches or payment terminals were affected.

Q4 : How can a site owner tell a DDoS from a normal traffic spike?

Compare access logs. Floods show many requests from widely spread addresses hitting the same few URLs, a jump in 429 and 5xx responses, and rising origin load with no matching rise in orders.

Disclaimer

This article is published for cybersecurity research and educational purposes only. CyberAsia.io reports the statements, screenshots and public data above as published and does not endorse cyberattacks, hacktivism or any unlawful activity. Statements attributed to RipperSec are the group’s own and have not been matched against records from BUG or its hosting providers.