Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)
Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
https://stolidityseashellshotter.com/ezrsb5dd1268e6f6ebaad42916d5d87b8133c0816d3e7
https://gullible-thanks.com/w5FDGiI presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.
I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.
I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.
The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.
Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.
(To be fair, that isn't the only redirect so you might need to click it a few times.)
Whereas other links (e.g. the immediate next one to arxiv) seem unaffected.
edit: That was a red herring. It seems to redirect all .pdf links I try that don't point to a valid snapshot. Very interesting.
Just for the sake of preserving what I did see, the URL linked in the text was:
https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf
https://archive.ph/https://schenklawfirm.com/wp-content/uplo...
curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \
--compressed \
-H 'User-Agent: [redacted]' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-H 'Accept-Language: en-US,en;q=0.9' \
-H 'Accept-Encoding: gzip, deflate, br, zstd' \
-H 'Connection: keep-alive' \
-H 'Cookie: [redacted but you dont need it actually]' \
-H 'Upgrade-Insecure-Requests: 1' \
-H 'Sec-Fetch-Dest: document' \
-H 'Sec-Fetch-Mode: navigate' \
-H 'Sec-Fetch-Site: cross-site' \
-H 'Sec-Fetch-User: ?1' \
-H 'Priority: u=0, i' \
-H 'TE: trailers' \
-H 'Pragma: no-cache' \
-H 'Cache-Control: no-cache' -vResponse headers mention an onion-location and link to stolidityseashellshotter... but also mementoweb... pretty strange. Most generously, maybe some kind of cache poison instead of explicit bad behavior?
This looks like some kind of misconfiguration more than intent, or a mix, but it's still bad.
Edit: It sure does seem to be a PDF problem, these were both NYT things, but I tried a CCC talk page that had a slides link and sure enough, same behavior.
https://archive.ph/o/n5qxb/https://fahrplan.events.ccc.de/congress/2015/Fahrplan/system/event_attachments/attachments/000/002/825/original/32c3-slides.pdfAnd it is federated so when the biggest Lemmy instance starts to suck, Lemmy can be the Lemmy replacement, too.
I understand that mentioning it on popular subreddits is verboten.
That's the entire reason I use old.reddit - the New Reddit backend is a pile of unreliable dung. Just like everything that is made with GraphQL.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
https://archive.ph/HcOq2 (This is a link to the post for this article)
(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)
Or, you can use on of the various Reddit scrapers, e.g:
https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...
Here’s a list of Reddit scrapers:
https://github.com/redlib-org/redlib-instances/blob/main/ins...
Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.
But even aside from opinions on their UX, they're aggressively experimenting with the login more... Even on the new UI I now semi-regularly see that I can read the initial post and one or two comments but as soon as I scroll past or try to expand a comment thread get a login prompt.