{"id":5373,"date":"2026-10-17T07:04:58","date_gmt":"2026-10-17T07:04:58","guid":{"rendered":"https:\/\/cyberasia.io\/?p=5373"},"modified":"2026-10-17T07:05:00","modified_gmt":"2026-10-17T07:05:00","slug":"thegarudaeye-ddos-hits-saudi-evisa-swa","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/ddos\/thegarudaeye-ddos-hits-saudi-evisa-swa\/","title":{"rendered":"TheGarudaEye DDoS Hits Saudi eVisa, SWA: 2 Critical Outages"},"content":{"rendered":"\n

TheGarudaEye<\/mark><\/strong> DDoS attacks took two Saudi websites offline in under 24 hours, based on the group’s own announcements and the outage screenshots posted with them. The visa portal<\/mark><\/strong> saudievisa.com<\/mark><\/strong> went down at 08:15 AM Saudi time on 8 October 2026. The public website of the Saudi Water Authority<\/mark><\/strong>, swa.gov.sa<\/mark><\/strong>, followed at 08:00 AM on 9 October 2026.<\/p>\n\n\n\n

The group numbered the incidents Global Cyber Attack #0138 and #0139, and stated a duration of 10,800 seconds, or three hours, for each. Supporting material included check-host reports, Cloudflare error pages, and uptime checker captures. The material reviewed for this report contains no response from either organization.<\/p>\n\n\n\n

\"Figure
Figure 1 : TheGarudaEye DDoS announcement for Global Cyber Attack #0138 listing saudievisa.com as the target with a three hour duration<\/figcaption><\/figure>\n\n\n\n

TheGarudaEye DDoS Timeline: Two Outages, One Campaign<\/h2>\n\n\n\n

Both posts follow one template: a target list, a duration, a server down time, a proof link, a message block, and a thanks line. The sequential numbering points to a running series, although earlier entries were not part of the material reviewed.<\/p>\n\n\n\n

Item<\/strong><\/td>Attack #0138<\/strong><\/td>Attack #0139<\/strong><\/td><\/tr>
Target<\/td>saudievisa.com<\/td>swa.gov.sa<\/td><\/tr>
Listed category<\/td>Saudi Arabia Companies<\/td>Saudi Arabia Government<\/td><\/tr>
Stated start (Saudi time)<\/td>8 Oct 2026, 08:15 AM<\/td>9 Oct 2026, 08:00 AM<\/td><\/tr>
Stated duration<\/td>10,800 seconds<\/td>10,800 seconds<\/td><\/tr>
Error evidence<\/td>SSL handshake failure<\/td>Error 522 and HTTP 503<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The two start times sit 23 hours and 45 minutes apart.<\/p>\n\n\n\n

Attack #0138: Saudi eVisa Portal Goes Dark<\/h2>\n\n\n\n

The first announcement lists Saudi Arabia Companies and the Saudi Arabian electronic tourist visa as targets, with saudievisa.com named explicitly. It records the outage start as 08:15 AM Saudi time on 8 October 2026 and attaches a check-host.net report.<\/p>\n\n\n\n

A companion graphic shows the site’s landing page, which advertises a Saudi eVisa processed before travel, beside a red server down icon. A browser capture displays a Cloudflare page stating that the SSL handshake failed<\/mark><\/strong>. Two uptime checker captures show the site reachable first and then down for everyone.<\/p>\n\n\n\n

\"Figure
Figure 2 : Server down graphic and SSL handshake failure capture for saudievisa.com posted by TheGarudaEye after the DDoS attack<\/figcaption><\/figure>\n\n\n\n

A handshake failure at the Cloudflare layer fits an origin server too busy to complete secure connections. Visitors would have met an error page instead of the application form. The captures show no data theft and no access to applicant records.<\/p>\n\n\n\n

Attack #0139: Saudi Water Authority Returns Error 522 and 503<\/h2>\n\n\n\n

The second announcement lists Saudi Arabia Government and the Saudi Water Authority (SWA), with swa.gov.sa named in the post. It gives 08:00 AM Saudi time on 9 October 2026 as the start and offers two check-host reports.<\/p>\n\n\n\n

\"Figure
Figure 3 : TheGarudaEye DDoS announcement for Global Cyber Attack #0139 naming the Saudi Water Authority and swa.gov.sa as the target<\/figcaption><\/figure>\n\n\n\n

The strongest capture shows the Arabic page swa.gov.sa\/ar\/ returning a Cloudflare Connection timed out page with error code 522<\/mark><\/strong>. A Saudi Arabia clock in the same image reads 08:00:49 on Friday, 9 October 2026, and the page timestamp of 2026-10-09 05:01:06 UTC converts to 08:01 AM Saudi time. The browser and the Riyadh Cloudflare edge are marked working, while only the host at www.swa.gov.sa shows an error.<\/p>\n\n\n\n

\"Figure
Figure 4 : Cloudflare Error 522 connection timed out page for swa.gov.sa with a Saudi Arabia clock showing 08:00 on 9 October 2026<\/figcaption><\/figure>\n\n\n\n

Posts forwarded from a feed the group labels TGE (Live Attack) repeat the 522 page, then show a mobile browser capture of swa.gov.sa returning HTTP Error 503, Service Unavailable. That capture is paired with a political cartoon of a burning American flag used as an umbrella, which says more about the campaign’s messaging than its method.<\/p>\n\n\n\n

\"Figure
Figure 5 : Forwarded live attack posts showing the Cloudflare 522 page and an HTTP 503 Service Unavailable error on swa.gov.sa<\/figcaption><\/figure>\n\n\n\n

What the Error Codes Suggest About the Attack Method<\/h2>\n\n\n\n

Cloudflare’s documentation explains that Error 522 appears when the origin web server fails to answer Cloudflare’s connection request in time<\/mark><\/a><\/strong>. Common causes include an overloaded or offline origin and dropped packets.<\/p>\n\n\n\n

Here the edge network stayed online while the origin stopped answering. That pattern usually means traffic reaching the origin was heavy enough to exhaust it, and the 503 response points the same way. The group has not published its method. A Layer 7 HTTP flood is a common candidate for this kind of TheGarudaEye DDoS outage, but nothing in the screenshots confirms it.<\/p>\n\n\n\n

The evidence has limits. The captures document each outage start, so the three hour duration rests on the group’s post. Check-host reports show reachability from several probe locations, which helps with timing but not attribution. No screenshot points to a breach, and nothing connects the SWA incident to water treatment or distribution systems. A DDoS attack targets the availability of a public website, not the operational technology behind it.<\/p>\n\n\n\n

OpSaudiArabia and OpBoP: The Message Behind the Outages<\/h2>\n\n\n\n

TheGarudaEye DDoS posts carry the tags #OpSaudiArabia, #OpBoP, #TheGarudaEye, #FreePalestine, and #WeAreRevolution. One graphic lists countries associated with the Board of Peace and outlines Saudi Arabia in a red box.<\/p>\n\n\n\n

The Board of Peace was launched by US President Donald Trump around the Gaza ceasefire plan. In January 2026, Saudi Arabia, Turkey, Egypt, Jordan, Indonesia, Pakistan, Qatar, and the United Arab Emirates announced they would join<\/mark><\/a><\/strong>, according to Al Jazeera.<\/p>\n\n\n\n

The message block is partly obscured in the screenshots. The visible text links the operation to money associated with the Board of Peace and refers to Palestinians in Gaza.<\/p>\n\n\n\n

\"Figure
Figure 6 : TheGarudaEye emblem with a gold Garuda crest inside a green and teal circuit board ring<\/figcaption><\/figure>\n\n\n\n

The emblem shows a Garuda head with a gold crest and green wings inside a ring of circuit board patterns. The material reviewed does not disclose where the group operates or who belongs to it<\/p>\n\n\n\n

How Admins Can Reduce DDoS Downtime<\/h2>\n\n\n\n

Any site behind a CDN can face the same 522 and 503 sequence if its origin is reachable and weakly protected. Admins can start here:<\/p>\n\n\n\n