Archive.today links going forward

Posted by consumer451 20 hours ago

Counter206Comment144OpenOriginal

Comments

Comment by consumer451 20 hours ago

Archive.today = archive.is - which is added via comment on a huge percentage of posts on HN.

Link to comment explaining the discovery:

https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.

Comment by shagie 18 hours ago

From historical posts on HN:

Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)

Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)

Comment by no-name-here 17 hours ago

> DDoS

I presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.

Comment by consumer451 15 hours ago

For everyone's information: r/Seattle's mod team has stickied this technical debrief in response to this HN post. We are the "external site" that is kinda brigading them.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Comment by opello 14 hours ago

The only thing I'd add is that I see redirects to at least two domains:

    https://stolidityseashellshotter.com/ezrsb5dd1268e6f6ebaad42916d5d87b8133c0816d3e7
    https://gullible-thanks.com/w5FDGi

Comment by 12 hours ago

Comment by 14 hours ago

Comment by Vaushite 14 hours ago

Wasn't the "victim" trying to get the "attacker" life in prison for the crime of archiving public information?

Comment by neuronexmachina 14 hours ago

What is this referring to? I tried to find when Jani Patokallio tried to get the people behind archive.today imprisoned, but can't find anything.

Comment by oytis 14 hours ago

Yeah, everyone is freaking out about the (not very efficient as I can see) DDoS attempt, but it was a response to a totally unprovoked attempt to deanon the maintainer which could cost them freedom at least - and us all the only more or less reliable paywall remover.

Comment by dspillett 10 hours ago

I tend to think that being an arsehole when provoke is still being an arsehole. There are other ways to defend against such an attack than sending the boys¹ round to play bully², that was no better than throwing bricks through all their windows and I assume that we are civilised enough here that wouldn't condone that.

I particularly dislike the fact that I was, unbeknownst to me at the time, was coopted as part of that brigade of brick throwers.

--------

[1] a significant chuck of the internet

[2] beat up his online resources

Comment by Analemma_ 13 hours ago

I don't really care about the motivation? Malware is malware.

Comment by consumer451 16 hours ago

To make my edit in the parent clear: HN mods have changed the title, to the exact title of the post reddit on r/seattle. This is understandable.

I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.

Comment by mahboi 19 hours ago

Version that doesn't require login: https://reddit.com/r/Seattle/comments/1xhf6qp/archivetoday_l...

I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.

Comment by dpark 19 hours ago

You said the same thing twice. “The site” == archive.today

The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.

Comment by 19 hours ago

Comment by LoganDark 19 hours ago

The archive.today site is the one injecting the malware, not the site being archived.

Comment by mahboi 19 hours ago

"It was discovered by a member of the mod team today that an article archived by archive.today had injected malware links into the archived article."

Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.

Comment by k00shball 18 hours ago

Go to https://archive.ph/jXv3A#selection-5079.208-5079.212 Click on "Filed on Tuesday" and it will redirect you to a site telling you to download something.

(To be fair, that isn't the only redirect so you might need to click it a few times.)

Comment by deepfriedrice 14 hours ago

It immediately stands out that that link is to a /wp-content URL. AKA wordpress. AKA PHP. AKA very recently vulnerable (and perhaps still)...

Whereas other links (e.g. the immediate next one to arxiv) seem unaffected.

edit: That was a red herring. It seems to redirect all .pdf links I try that don't point to a valid snapshot. Very interesting.

Comment by mahboi 17 hours ago

Thanks, that's pretty much all I was looking for. Was able to reproduce but then started getting 429s.

Comment by opello 16 hours ago

I reproduced it too but was hoping to get a log, now all I get is 429 as well.

Just for the sake of preserving what I did see, the URL linked in the text was:

    https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf
and that now seems to have been purged from the archive.today cache, as this page says "No results":

https://archive.ph/https://schenklawfirm.com/wp-content/uplo...

Comment by mahboi 15 hours ago

You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site:

  curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \
  --compressed \
  -H 'User-Agent: [redacted]' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: [redacted but you dont need it actually]' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Sec-Fetch-Dest: document' \
  -H 'Sec-Fetch-Mode: navigate' \
  -H 'Sec-Fetch-Site: cross-site' \
  -H 'Sec-Fetch-User: ?1' \
  -H 'Priority: u=0, i' \
  -H 'TE: trailers' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' -v

Comment by opello 15 hours ago

Interesting. Same behavior here with a generic User-Agent and no Cookie header at all.

Response headers mention an onion-location and link to stolidityseashellshotter... but also mementoweb... pretty strange. Most generously, maybe some kind of cache poison instead of explicit bad behavior?

Comment by mahboi 14 hours ago

The page has other links that all go to archive.today. Seems like any link to a PDF causes this to happen. https://archive.ph/Y6BOX near "Download the PDF, which contains the dolls and all of the looks, here." Wonder if it's all links in general that aren't archived.

This looks like some kind of misconfiguration more than intent, or a mix, but it's still bad.

Comment by opello 14 hours ago

Wow, yeah, same two redirects for that PDF link. Geez. It'd sure be interesting to know the full cause here, otherwise it really destroys a lot of trust in the tool.

Edit: It sure does seem to be a PDF problem, these were both NYT things, but I tried a CCC talk page that had a slides link and sure enough, same behavior.

    https://archive.ph/o/n5qxb/https://fahrplan.events.ccc.de/congress/2015/Fahrplan/system/event_attachments/attachments/000/002/825/original/32c3-slides.pdf

Comment by 15 hours ago

Comment by stordoff 14 hours ago

[dead]

Comment by stavros 13 hours ago

I think they meant it as in "an article archived by archive.today had malware links injected into the archived article."

Comment by 19 hours ago

Comment by vadansky 18 hours ago

TIL; I always thought it was part of archive.org and I never understood why people hated it. Now I get it

Comment by grimgrin 18 hours ago

no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com

Comment by RunSet 12 hours ago

Lemmy is shaping up to be the reddit replacement.

And it is federated so when the biggest Lemmy instance starts to suck, Lemmy can be the Lemmy replacement, too.

I understand that mentioning it on popular subreddits is verboten.

https://lemmy.world/

Comment by consumer451 18 hours ago

Thanks for the reminder. Theoretically, I know this, but it’s a really hard habit for me to drop.

Comment by Akronymus 18 hours ago

you used to be able to set the redesign_optout cookie to true, but that doesnt seem to work anymore as of like a day ago for me

Comment by qingcharles 18 hours ago

They just demoed an entirely new version of Old Reddit at ModWorld. Same front-end but runs on the New Reddit backend.

Comment by kuschku 17 hours ago

Is that the version that looks like old reddit, but also only loads just as few comments as new reddit, and just as few nesting layers?

Comment by reddalo 13 hours ago

The fact that only some comments are loaded it's so infuriating. It's the main reason I stopped using Reddit altogether.

Comment by mschuster91 17 hours ago

> Same front-end but runs on the New Reddit backend.

That's the entire reason I use old.reddit - the New Reddit backend is a pile of unreliable dung. Just like everything that is made with GraphQL.

Comment by arprocter 19 hours ago

Looks like ClickFix impersonating GitHub

https://en.wikipedia.org/wiki/ClickFix

Comment by k00shball 18 hours ago

Ahh thanks... I hadn't heard of "clickfix" before.

Comment by paulpauper 11 hours ago

it's the worst possible malware. very deceptive

Comment by abeyer 19 hours ago

Hmmm... any other day I'd think that I need archive.today to get past reddit's login wall to read that.

Comment by consumer451 17 hours ago

You wouldn't have, if I could get out of the habit of posting old.reddit links.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Comment by strenholme 18 hours ago

And, indeed, you can use archive.today to get past the login wall:

https://archive.ph/HcOq2 (This is a link to the post for this article)

(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)

Or, you can use on of the various Reddit scrapers, e.g:

https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...

Here’s a list of Reddit scrapers:

https://github.com/redlib-org/redlib-instances/blob/main/ins...

Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.

Comment by mahboi 17 hours ago

You can just not use old.reddit.com. Regular reddit.com works without login.

Comment by abeyer 11 hours ago

Old still exists and gets heavy use a decade or so later exactly because regular reddit just doesn't work at all, even when you're logged in.

But even aside from opinions on their UX, they're aggressively experimenting with the login more... Even on the new UI I now semi-regularly see that I can read the initial post and one or two comments but as soon as I scroll past or try to expand a comment thread get a login prompt.

Comment by mahboi 10 hours ago

I dunno, used the regular one and it worked fine. Probably not for long.

Comment by drusepth 17 hours ago

Maybe this will be enough to finally rule against paywalled submissions here on HN.

Comment by paulpauper 11 hours ago

that is almost everything nowadays though. and not all paywall sites give paywalls all the time

Comment by lxe 18 hours ago

Again? This happened before, if you remember this: https://www.tomshardware.com/software/search-engines/archive...

Previous HN thread:

https://news.ycombinator.com/item?id=46624740

Comment by surround 17 hours ago

If you're brave enough to want to see it yourself, visit https://archive.ph/jXv3A#:~:text=filed%20on%20Tuesday then click on the "Filed on Tuesday" link.

It redirected me to https://stolidityseashellshotter[.]com/ezrsb5dd1268e6f6ebaad... which then redirected me to a fake clone of RT news: https://rurtnews[.]com/

Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.

Edit: I clicked it a few more times and its redirecting me to either the fake RT or https://gullible-thanks[.]com/w5FDGi, which redirects to either https://sportshard[.]com/ or https://eatcells[.]com/land/?token=[a random string]

I had to disable uBlock Origin, since it does something to block many of these redirects.

Comment by avidruntime 16 hours ago

I wonder if the redirect target is region based, because my redirect took me to the fake Github page. I'm in the US. A fake RT article rhymes with the well established doppelganger propaganda campaign, which could rationalize why it would be region based. The irony of the doppelganger campaign being a Russian state-sponsored campaign is not lost on me.

Comment by tyrabound 13 hours ago

Without clear and irrefutable evidence, which is nearly impossible, the Vault 7 releases should have been more than adequate to quell any doubts that you can believe any kind of claim of foreign campaigns. Why would a V Russian operation link to a fake RT site? A discerning individual world always anime that whatever you are being directed towards is the least likely accurate/correct thing.

Comment by qingcharles 10 hours ago

This sounds like the same hack that took over btdig.com -- some weird sort of region-based redirect that doesn't affect everyone.

[in fact, I just tried btdig.com and it tried to redirect me to the same site: guillible-thanks.com or whatever]

Comment by consumer451 16 hours ago

> Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.

Well, this got on the front page of HN... Such things make even FAANG behemoths pay attention. What I mean is, who knows what happened since r/Seattle called it out.

Does some other archive, archive the archiver?

There might be a cryptographic solution for this problem, but that's far beyond my knowledge set.

Also, as the peer comment pointed out, it could be geo-scoped. You know, like a targeted attack.

The entire reason that I posted this originally is that I cannot think of a juicier userbase than HN. We all post archive.is links every single time. Given that operator's history, we are doing the link-click analogy of pasting shell commands from the web into our terminals. We should know better by now, but complacency leads to ___.

Comment by 16 hours ago

Comment by aaron695 13 hours ago

[dead]

Comment by efficax 18 hours ago

They really need to show some evidence for this! Just this suggestion means I won't ever use it again

Comment by consumer451 11 hours ago

They eventually did, after we all started to ask questions and gave those poor unpaid mods a ton of work:

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Comment by 18 hours ago

Comment by nly 12 hours ago

How do they know the origin didn't detect archive.todays crawler and serve it malware?

Comment by avidruntime 18 hours ago

Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy extension of the aforementioned drama

Edit: Another r/seattle moderator (not the OP of the original post) has posted their technical writeup of the malware, which is detailed and definitely more in line with what we'd expect with this kind of PSA. While I stand by all criticisms of the OP moderator and their initial handling of the disclosure, you can find the details of the incident in this excellent write up: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Comment by no-name-here 16 hours ago

Archive.today has been caught intentionally using JS in the past to target others maliciously, so probably better not to give them the benefit of the doubt: https://www.tomshardware.com/software/search-engines/archive...

Comment by RobotToaster 12 hours ago

In that case he was targeting someone who was attempting to dox him to get him arrested. What would be the motivation in this case?

Comment by no-name-here 5 hours ago

The reporting describes it as:

> … a blog post from 2023, where the researcher looked into what makes Archive Today tick.

> The exposé reads as mostly positive, even suggesting that folks donate to Archive Today, as it provides a valuable service to the online community. Among the post's contents, Patokallio shows relatively slim and unverified findings about the Archive's operator's (or operators') identities and their income sources.

Is your argument that it's legitimate to intentionally cause user's PCs to conduct a malicious DDoS against someone who has possibly revealed who is operating a service and/or committing crimes? If someone posted that OpenAI had committed a crime or revealed its backers, would it be defensible for OpenAI to insert code for every ChatGPT.com visitor to make requests to that user's site every 0.3 seconds?

Or do you not think the archive.today operator's existing actions are defensible?

Comment by bulder 11 hours ago

Same kind of spite that led them to block the entire country of Finland? The site owner clearly isn't above attacks based on existing in the same country as someone who's slighted them.

Comment by eyya 5 hours ago

This wasn’t the first incident involving Finland and its government since the archive was established, nor was it even the second.

And when you consider that Jani Patokallio isn’t just some random, curious, cybersecurity blogger, but the ~40-year-old son of a high-ranking Finnish official who suddenly took up slighting and doxing, the story takes on a whole new dimension and it’s hard to come up with a benign explanation for his curiosity: either you’re being hounded by the deep state or a wealthy nutcase.

Comment by Ukv 18 hours ago

Seems unlikely to be the case here if what one of the mods said is true:

> We verified this isn't just us or just this source (it's a link in a NYT article to a PDF anyway, about the most safe combo I can think of)

Might be able to find the article in question by looking for NYT links posted to the subreddit recently (if the presumably-deleted archive link was posted separately as a reply).

Comment by avidruntime 18 hours ago

Perhaps, but it could also just be "take our word for it" devolving into more "take our extended word for it". Being prepared to make an alarming enough claim that it sparks discussion outside of the sub but being unwilling to provide evidence remains suspicious.

That suspicion becomes more grounded when the conversation with the subreddits mod regarding why the claim was made without a willingness to provide evidence looks like this:

>If you're going to make an allegation like this, it's necessary to be specific. Specifically, what is the malware, and what is the evidence that it was "injected"? This is "consult a security researcher" and "speak to the media" territory, not "mod announcement" territory.

>>No it's not. These archive sites are a legal gray area anyway. We don't have to consult anyone to decide not to allow the links. No we are not talking to the media, we're not providing research, or a proof. I'm not calling the mayor. We are reddit mods . This is purely about community management.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Comment by Ukv 17 hours ago

Found it: archive[.]is/jXv3A

Originally posted here: https://www.reddit.com/r/Seattle/comments/1xh57il/removed_by...

The "filed on Tuesday" link seems to go to gullible-thanks[.]com, which redirects to random shady sites.

Comment by avidruntime 17 hours ago

Reproduced on my end too.

Comment by 15 hours ago

Comment by lysace 18 hours ago

It looks like some reddit mods on a power trip. Zero actual evidence presented.

Edit: Now there is something here: https://www.reddit.com/r/Seattle/comments/1xhf6qp/comment/19...

Comment by avidruntime 18 hours ago

Is it a power trip stemming from a technical misunderstanding (archive.today exploited to deliver malware =/= archive.today attempting to deliver malware) or is it something else? In any case, reading the comments on reddit, seems like the mods are going out of their way to appeal to hysterics.

Unbelievable that the comment asking for evidence sits at -24 upvotes in that thread as of now. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Comment by tyrabound 13 hours ago

As much effort that has been put into trying to subjugate and control archive.today, it makes me immediately leery of believing any of this was some kind of deliberate thing on behalf of archive.today.

It’s not to say it’s not so, but people are fools to just chomp down on the bait.

Comment by mahboi 17 hours ago

Seems like the moderators don't know what's going on and are blacklisting it out of abundance of caution. Cause whether the malware comes from the archived site or the archiver itself, it means the archiver isn't safe in a way. Which is fine. It's just ridiculous that someone is asking for details and getting ostracized as a result.

Comment by avidruntime 17 hours ago

I disagree with your characterization of that the mods don't know what's going on.

The moderators seem to be making it quite clear: they do know what is going on and the onus is not on them to prove it, only to notify actions have been taken in response. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

This attitude is extended when someone else asks a question about evidence, instead of replying to the question, the moderator sarcastically calls out the commentor for posting in the sub for the first time: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

The moderator conflates questions about evidence and requests for more details as "making demands" https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Its unusual and arguably suspicious because this attitude is antithetical to the stated point of the thread: To make a PSA to the community. They've also limited the comment section to only flaired users, which seems quite unusual given that this thread is ground-zero for a newsworthy claim.

Comment by mahboi 17 hours ago

Eh, still think simplest explanation is most likely here, which is that there's no secret motive, but the mods and some users over there are just dumb. I don't mean because they're nontechnical or don't have randomly specific web knowledge (one of them actually does), it's about how they responded to people.

Comment by avidruntime 17 hours ago

Now that the evidence is shared and reproducible, I agree with you. This should be an embarrassing moment for the r/seattle mods, but I somewhat doubt it will be. Glad a more level headed conversation found its way to HN.

Comment by Arainach 16 hours ago

What's to be embarassed? These are busy community moderators, not whitehat hackers. They don't owe anyone a writeup of technical vulnerabilities. They owe the community clear communication of rule changes and most people expect explanation of why rules were changed, and they delivered both.

Comment by mahboi 16 hours ago

They did actually made a technical claim, which is fine, but then when someone said this is serious and asked for details, they responded with attitude and defensiveness. The mods don't need to be white-hat hackers, and even if they were, they're still dumb. They could've just said, all we know at the moment is we kept getting redirected to this malware site, so we're blocking this.

The craziest part is the guy asking even apologized, probably cause he was getting downvoted too much and actually cares about appeasing them.

Comment by Arainach 14 hours ago

Community moderator is a stressful thankless job, especially on a subreddit with a reasonable amount of (often political) content, PARTICULARLY on one regularly brigaded by trolls and antagonists from a competing subreddit, so I'm going to cut a lot of slack to the unpaid volunteers who put up with a lot of hate directed at them.

Comment by jrflowers 16 hours ago

> This should be an embarrassing moment for the r/seattle mods, but I somewhat doubt it will be.

Imagine the shame of blocking the spread of malware before attempting to appease somebody that’s falsely accusing of you hysterics.

Every day I wake up and shake my head that another mod on the internet did something without my, the Grand Regent of Online, say so

Comment by mahboi 17 hours ago

I read through the comment thread there. There's almost no explanation of what's going on, not even the offending URL. When someone asked, he got downvoted a bunch and ridiculed, which reminds me of why I don't have a Reddit account. I don't trust archive.today because of its track record but don't trust this particular allegation either. The news is simply that a subreddit moderator blacklisted archive.today.

Comment by avidruntime 17 hours ago

And about 30 minutes ago, they switched the reddit post to flaired user only for comments.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Not sure if this post even qualifies to be on hacker news...its all rumors and any attempt to distill the incident to its facts is met with pushback.

Comment by mahboi 17 hours ago

They've added a comment explaining what they saw, with the offending URL. It's indeed archive.today itself sending visitors to the malware download site.

Comment by avidruntime 17 hours ago

I see that now too!

Comment by ballon_monkey 17 hours ago

> When someone asked, he got downvoted a bunch and ridiculed, which reminds me of why I don't have a Reddit account.

This happens on HN too.

Comment by mahboi 17 hours ago

No it doesn't. Aside from people here actually being curious about things, the site itself isn't designed for flame wars. It also makes it hard to get downvoted so much that your account goes into questionable standing. I'm guessing people on Reddit fix that by farming karma somewhere else, but no way am I going to bother with that.

Comment by ballon_monkey 17 hours ago

HN isn't designed for flame wars sure, but comments regularly get down voted till hidden just for having a differing opinion.

Edit: Not being able to down vote till 300 points is a good thing tho, does prevent new accounts being created just to down vote.

Comment by Karrot_Kream 15 hours ago

FWIW it's quite easy to farm karma to get to the downvote threshold. If you go to any of the energetic political HN threads, you just need to submit an enthusiastic comment that is pro the dominant position and you'll get tens of upvotes quite quickly. Do that for a week and you'll be ready to downvote. Before HN had LLM detection I had an experiment with an LLM doing that (though I approved everything it wrote by hand) and farmed karma very quickly. I stopped because I felt quite gross about it, but realize it's probably trivial to do now.

The problem isn't really the site, it's the people. People like smashing the up and down buttons on things they agree with and unfortunately a comment's score affects where it shows up on the page.

Comment by 15 hours ago

Comment by 15 hours ago

Comment by Permik 19 hours ago

The writing had been on the wall for a while. Hopefully this'll finally drive the usage of the site down.

Comment by knowaveragejoe 18 hours ago

What are the alternatives besides the IA?

Comment by s_dev 17 hours ago

https://periscope.corsfix.com/

Comment by charcircuit 4 hours ago

I would recommend

https://ghostarchive.org/

Comment by LoganDark 19 hours ago

Surprised that using visitors for DDoS attacks wasn't enough already.

Comment by Hamuko 19 hours ago

There's been quite a lot of people still defending the site. Basically "who cares about DDoS attacks and altering archived sites' content when it allows bypassing paywalls?"

Comment by 1317 18 hours ago

well, yeah

Comment by LoganDark 19 hours ago

Setting my user-agent to Googlebot in a private window bypasses most paywalls just fine. Surprised at how many sites aren't checking against the published IP ranges.

Comment by worksonmine 18 hours ago

The few people willing to change their user-agent aren't worth the extra complexity.

Comment by john_strinlai 19 hours ago

not sure why this is downvoted. they modified their captcha so that visitors contributed to a ddos against a blog, on top of a handful of other threats, tampering of archived data, etc.

they are not great people.

Comment by burningChrome 18 hours ago

As a personal vendetta against Jani Patokallio (a Finnish cybersecurity blogger) who was trying to unmask the person who ran the site - which goes back to 2023.

Comment by MisterMunchkin 18 hours ago

I don't really care about that though, because trying to dox someone and get them killed isn't a good or moral thing to do. You could easily just not do that. You have to really go out of your way to try and hunt someone down, and at any point you could just not do it. For the targeted person to want revenge is just an inevitability.

Comment by cowlevel 13 hours ago

Did you make an archive site we can use instead?

Comment by linhns 12 hours ago

Why do you need archive if you can disable JS for most website?

Comment by cowlevel 12 hours ago

So I can view the article

Comment by john_strinlai 13 hours ago

i can certainly spin one up, use your site visits to DDoS people i dont like, and secretly edit the archived content if you want? apparently that will win me an army of hn defenders.

so fucking strange that people are playing defense for that. even forgetting the DDoS part, people don't care that they are editing archived content? wild.

Comment by cowlevel 12 hours ago

Can you tell me the address of the site and I'll tell all my friends to use it instead of archive.today?

Comment by AyyEye 18 hours ago

Residential proxies DDoSing half the internet is standard operating procedure this decade and yet everyone still buys connected garbage and monetizes their apps this way.

Comment by 15 hours ago

Comment by ada-h00k 18 hours ago

I think it's a shame that copyright laws don't allow us to host a non shady alternative to this. The only reason people use such dubious sites is that there's no other way to share a link to a news site without risking that the text will be altered later or hidden behind a paywall.

Comment by strenholme 17 hours ago

One legal way to share news stories which generate controversy is to have an AI make a summary of the article, rewording it to remove any copyright from the article (this legal trick only works when the news site in question is reporting on factual events, since facts can’t be copied as per Feist vs. Rural 1991, and I make sure that the summary has “a different sequence, pace, and setting than the original article” as per legal judgments on whether an AI summary of factual events as reported by a news source is subject to copyright).

Comment by consumer451 9 hours ago

What about just a copy and paste into an HN post comment? What is the legality of that? What if someone who reads a share, and then pastes it as a comment?

Genuine question here.

Comment by strenholme 36 minutes ago

While Righthaven LLC v. Hoehn did rule that copying and pasting an entire newspaper article is fair use, this ruling was vacated on appeal and instead the lawsuit was nullified because they ruled Righthaven never had the right to bring the lawsuit in the first place. So, yes, one can be sued for copying and pasting a newspaper article verbatim.

Comment by Brian_K_White 12 hours ago

Then it's no longer a record.

It might be useful for your own memory since you can decide that you trust what was written. IE you trust that when it was written, you agreed at the time that it was an accurate summary, and later you only have to trust your earlier self.

But "My ai said that the site said ~essentially~ this on this date." is useless for anything else.

But it suggests an interesting idea. Maybe if we had some ai equivalent of trusted vetted accountable court reporters who write down notes and draw sketches in rooms where cameras aren't allowed.

That is purely second-hand reporting that we more or less trust, partly because there is usually more than one of them from competing venues reporting on the same event, partly because they are people with something to lose if they are unfaithful or even merely inept, partly because the facts are ultimately vettable with some effort for those who really need to.

There's no such ai yet. Even if one exists that could do the job, there is no consensus or basis for it, for everyone to recognize it as a trustworthy source of second hand reporting. But maybe if there were more than one and operated by different camps, they could grow to become recognized as a valid source of info.

Comment by keoneflick 10 hours ago

NYT is $4 per month, and you can then share gift links.

Why should journalism be free? Is $4 not an appropriate price for real journalism? If not, then what?

Your library if it's in the US also likely maintains access to NYT archives.

Comment by Dylan16807 8 hours ago

How hard can you guarantee that $4?

Because that's not what NYT says the price is. They say it's over $30 after the intro period.

Comment by ada-h00k 5 hours ago

Not every newspaper offers the option to share gift links. Besides, it's unrealistic to subscribe to every single newspaper. I have 2 regular newspapers that I read every day, and other than that, I'm usually interested in just 2 or 3 articles from other papers. I can't subscribe to 50 different newspapers a month. Besides, the articles that could be archived using archive.today is all content that was once available online without a paywall. If a site posts an article that’s publicly accessible, people should be allowed to archive it. If they later add a paywall or use some weird cookie mechanisms to annoy people it's their problem. If they don’t want it to be archived, they have to put it behind a login wall.

Comment by consumer451 11 hours ago

A few hours after I posted this: I am so glad that r/seattle mods found this, and the HN community requested/forced a prelimiary write up [0] (sorry to Jaco_Belordi to force the write up, and to spoiled__princess who actually found this (but had to go to pottery class) + rest of team - you probably have other jobs as well :). This is the system working as intended. This is the best of the modern Internet.

Here are my suppositions and questions:

The frontier labs feel free to use the path of least resistance to acquire more data. Currently, one of those paths must be archive.today. Proof of that is that an archive.is link is posted here on HN, for any news post, right? I certainly find those links useful.

So, now that we know that archive.today is the easiest path to paywalled data, is a threat actor, and can poison training data...

1. What is their valuation?

2. Will the labs stop using them? Is it even fair to assume that they are?

3. ... ?

[0] https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Comment by eyya 11 hours ago

But this might be the reason: to make the archive unexciting for AI scrapers

Comment by consumer451 10 hours ago

I am open to chat about any of this. Threat modeling is complex.

But, injecting malware to scuttle their own incredibly popular network would benefit them how?

Comment by eyya 10 hours ago

Its incredible popularity has long since led to the emergence of virtually unsolvable CAPTCHAs, designed to reduce this level.

So far, the only benefits of this popularity are the AI crawlers which cause the site to run intermittently (same issue this year with archive.org and commoncrawl) plus Finnish doxxers and fake child-porn fighters trying to shut it down.

Comment by consumer451 10 hours ago

OK, but what if they track all of who watches what. Isn't that the entire Facebook model? Metadata is extremely valuable. That's just facts, right? And, they are literally doing that.

Next, IIRC, one DNS provider stopped working with them for insane privacy reasons? [0]

Now, tinfoil hat time: what about the AI labs using them for training data, and it getting steered one way or another now that we know for a fact that archive is not reliable?

[0] It is Cloudflare due to EDNS Client Subnet (ECS) privacy, right?

Comment by eyya 9 hours ago

You have to hang out on Epstein Island to find buyers for metadata. Have you heard of any small indie projects with this kind of business model? Maybe PirateBay, Sci-Hub, Flibusta? I haven't. That's why I'm sure CloudFlare is selling your metadata (and not just that), but the archive isn't. Simply because it doesn’t fly that high. Banners, pop-unders, pop-ups—what people here like to call “malware”—yes, that’s it. Just a normal pirate website with too many too cheap visitors and an unpassable captcha and a pop-under as the result.

Comment by consumer451 9 hours ago

What makes you think that archive.today is any kind of indie project?

Isn't just the scale of cost indicative that is not aligned with anything close to indie?

Comment by eyya 9 hours ago

comparable to the 3 websites mentioned

Comment by consumer451 9 hours ago

Is it really? Archive.today is like archive.org. Archive.org is around 30M/year at least, we know those costs and the funding is open. Does that sound indie on the .today side? Who is funding that?

You are really defending .today, and you mentioned Flibusta.

Well, now we now who. Сердечный приве. I look forward to our eventual reunion my Slavic brothers and sisters. We all left our imperialist moron leaders behind, so will you. I cannot wait for the peace and prosperity to come.

Comment by eyya 6 hours ago

30 million is on the scale of Pirate Bay, slightly less than Kim Dotcom’s Megaupload (150M), and 3–4 orders of magnitude smaller than Facebook. So yes, by my definition, archive.org is a small, indie project as well still operating out of someone’s garage.

Comment by 9 hours ago

Comment by 11 hours ago

Comment by 19 hours ago

Comment by armchairhacker 16 hours ago

But…why?

Comment by kragen 19 hours ago

Disappointing but not that surprising; it's been banned from Wikipedia for months because it was enlisting viewers' computers in a DDoS against an investigative journalist for trying to figure out who was behind it. But it's the only way I've found to access a lot of information that is otherwise lost. So, what do we do?

Comment by humodz 18 hours ago

for anyone interested, here's a writeup of the DDoS story: https://web.archive.org/web/20260203073744/https://gyrovague...

Comment by sfoley 19 hours ago

Weren't they also caught modifying their "archived" content?

Comment by danso 18 hours ago

That's been my nagging fear about them too. Obviously it's not an option they'd want to exercise frequently, but it could be devastating to individual targets.

(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)

Comment by throw0101c 18 hours ago

On modifying bits, see perhaps this comment from a discussion ~8 months ago:

* https://news.ycombinator.com/item?id=47092006#47100204

* https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...

Comment by mahboi 18 hours ago

Hm, someone in the first thread mentioned a Reddit cofounder did something like this too

Comment by iamnothere 17 hours ago

Yes, and archiving as a practice became popular when people noticed that media sites were beginning to edit or delete articles without listing a correction, sometimes after the story had already circulated widely. Previously, editors would usually make a note of such things.

(This is why archives that bypass paywalls are particularly important. I wish we had more options here.)

Comment by nbajka 19 hours ago

You keep using it as normal and if it tells you to copy and paste commands into your terminal you DO NOT do it?

Comment by mahboi 18 hours ago

tbh yeah, this isn't my first time visiting a sketchy website and won't be my last

Comment by kvemkon 17 hours ago

> investigative journalist

I think there is a confusion of blogger with a registered journalist, who must follow journalist's (ethic) rules.

Comment by whalesalad 13 hours ago

Is there an alternative service people like?

Comment by motionlessveloc 12 hours ago

https://wallhop.io/ is useful, but it doesn't support many top-tier news sites.

It also automatically redirects you to archive.today as backup if its own attempt fails.

Comment by 11 hours ago

Comment by g-b-r 13 hours ago

I guess that we know how they pay the bills now

Comment by Onavo 18 hours ago

Until somebody invents a solution for bypassing paywalls at scale, they are not going away. It's like people asking "why don't AI companies release their training data".

Comment by paulpauper 11 hours ago

it can be done. the problem is not cheap enough to make it worthwhile.

Comment by 1vuio0pswjnm7 15 hours ago

"We investigated the "filed on Tuesday" link in an archived NYT article (hxxps://archive.ph/jXv3A). It's supposed to lead to a lawsuit PDF hosted by the plaintiff's law firm. Instead, clicking the link leads to an ad/phishing network and intermittently serves instructions to run elevated cURL commands, advertising pages, and ZIP-downloads.

Archive.today's /o/ endpoint itself returned the instruction to redirect, not the original source URL. We observed this in more formal testing on October 28, 2026, at approximately 07:35 UTC.

The link's actual href on the archived version of the page was:

hxxps://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-o..."

As it happens, and this is quite common, use of archive.today was not necessry

https://www.courthousenews.com/wp-content/uploads/2026/10/wa...

No "bot protection"

Comment by 1vuio0pswjnm7 16 hours ago

Beware that wallhop.io sometimes forwards requests to archive.{today,is,md,ph,etc.}, e.g., for WSJ

Comment by 1vuio0pswjnm7 13 hours ago

No "archive site" is required for WSJ

Managing the client software's use of HTTP headers, Javascript and/or CSS works just fine

Comment by mitxela 14 hours ago

You can solve this problem by creating your own WSJ archive site. Until then, there are no alternatives.

Comment by 18 hours ago

Comment by ohra 5 hours ago

[flagged]

Comment by CreepyHunterX 18 hours ago

Either the payload was already present in the captured snapshot (in which case the original is at fault), or it was added by the server or the rendering layer of the archive.today service

Comment by slipperybeluga 18 hours ago

how about some details? This just reads like every other reddit shitpost. What malware? What sites were affected that they noticed? How did they discover it? When did they discover it? So many questions.

Comment by aaron695 19 hours ago

[dead]

Comment by altairprime 15 hours ago

[flagged]

Comment by avazhi 18 hours ago

That sucks I guess but until there’s an alternative I don’t really care.

Comment by ferngodfather 16 hours ago

Wikipedia has blocked it for years. Glad everyone else is finally getting around to it.

Comment by frenchtoast8 12 hours ago

If by “years” you mean “8 months” then yes. https://en.wikipedia.org/wiki/Wikipedia:Archive.today_guidan...

Comment by wlonkly 13 hours ago

They banned it this past February, after the DDoS captcha incident in January.

https://en.wikipedia.org/wiki/Wikipedia:Wikipedia_Signpost/2...