From historical posts on HN:

Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)

Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)

> DDoS

I presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.

For everyone's information: r/Seattle's mod team has stickied this technical debrief in response to this HN post. We are the "external site" that is kinda brigading them.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

The only thing I'd add is that I see redirects to at least two domains:

    https://stolidityseashellshotter.com/ezrsb5dd1268e6f6ebaad42916d5d87b8133c0816d3e7
    https://gullible-thanks.com/w5FDGi

Wasn't the "victim" trying to get the "attacker" life in prison for the crime of archiving public information?

Yeah, everyone is freaking out about the (not very efficient as I can see) DDoS attempt, but it was a response to a totally unprovoked attempt to deanon the maintainer which could cost them freedom at least - and us all the only more or less reliable paywall remover.

Version that doesn't require login: https://reddit.com/r/Seattle/comments/1xhf6qp/archivetoday_l...

I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.

You said the same thing twice. “The site” == archive.today

The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.

The archive.today site is the one injecting the malware, not the site being archived.

"It was discovered by a member of the mod team today that an article archived by archive.today had injected malware links into the archived article."

Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.

Go to https://archive.ph/jXv3A#selection-5079.208-5079.212 Click on "Filed on Tuesday" and it will redirect you to a site telling you to download something.

(To be fair, that isn't the only redirect so you might need to click it a few times.)

Thanks, that's pretty much all I was looking for. Was able to reproduce but then started getting 429s.

I reproduced it too but was hoping to get a log, now all I get is 429 as well.

Just for the sake of preserving what I did see, the URL linked in the text was:

    https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf

and that now seems to have been purged from the archive.today cache, as this page says "No results":

https://archive.ph/https://schenklawfirm.com/wp-content/uplo...

You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site:

  curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \
  --compressed \
  -H 'User-Agent: [redacted]' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: [redacted but you dont need it actually]' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Sec-Fetch-Dest: document' \
  -H 'Sec-Fetch-Mode: navigate' \
  -H 'Sec-Fetch-Site: cross-site' \
  -H 'Sec-Fetch-User: ?1' \
  -H 'Priority: u=0, i' \
  -H 'TE: trailers' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' -v

Interesting. Same behavior here with a generic User-Agent and no Cookie header at all.

Response headers mention an onion-location and link to stolidityseashellshotter... but also mementoweb... pretty strange. Most generously, maybe some kind of cache poison instead of explicit bad behavior?

The page has other links that all go to archive.today. Seems like any link to a PDF causes this to happen. https://archive.ph/Y6BOX near "Download the PDF, which contains the dolls and all of the looks, here." Wonder if it's all links in general that aren't archived.

This looks like some kind of misconfiguration more than intent, but it's still bad.

To make my edit in the parent clear: HN mods have changed the title, to the exact title of the post reddit on r/seattle. This is understandable.

I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.

TIL; I always thought it was part of archive.org and I never understood why people hated it. Now I get it

no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com

you used to be able to set the redesign_optout cookie to true, but that doesnt seem to work anymore as of like a day ago for me

They just demoed an entirely new version of Old Reddit at ModWorld. Same front-end but runs on the New Reddit backend.

Is that the version that looks like old reddit, but also only loads just as few comments as new reddit, and just as few nesting layers?

> Same front-end but runs on the New Reddit backend.

That's the entire reason I use old.reddit - the New Reddit backend is a pile of unreliable dung. Just like everything that is made with GraphQL.

Thanks for the reminder. Theoretically, I know this, but it’s a really hard habit for me to drop.

Looks like ClickFix impersonating GitHub

https://en.wikipedia.org/wiki/ClickFix

Ahh thanks... I hadn't heard of "clickfix" before.

Hmmm... any other day I'd think that I need archive.today to get past reddit's login wall to read that.

And, indeed, you can use archive.today to get past the login wall:

https://archive.ph/HcOq2 (This is a link to the post for this article)

(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)

Or, you can use on of the various Reddit scrapers, e.g:

https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...

Here’s a list of Reddit scrapers:

https://github.com/redlib-org/redlib-instances/blob/main/ins...

Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.

You can just not use old.reddit.com. Regular reddit.com works without login.

You wouldn't have, if I could get out of the habit of posting old.reddit links.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

Maybe this will be enough to finally rule against paywalled submissions here on HN.