upvote

points

by mahboi7 hours ago |
comments
upvoteby k00shball6 hours ago|
next
[-]
Go to https://archive.ph/jXv3A#selection-5079.208-5079.212 Click on "Filed on Tuesday" and it will redirect you to a site telling you to download something.

(To be fair, that isn't the only redirect so you might need to click it a few times.)

reply
upvoteby deepfriedrice2 hours ago|
parent|
next
[-]
It immediately stands out that that link is to a /wp-content URL. AKA wordpress. AKA PHP. AKA very recently vulnerable (and perhaps still)...

Whereas other links (e.g. the immediate next one to arxiv) seem unaffected.

edit: That was a red herring. It seems to redirect all .pdf links I try that don't point to a valid snapshot. Very interesting.

reply
upvoteby mahboi6 hours ago|
parent|
prev|
next
[-]
Thanks, that's pretty much all I was looking for. Was able to reproduce but then started getting 429s.
reply
upvoteby opello4 hours ago|
parent|
[-]
I reproduced it too but was hoping to get a log, now all I get is 429 as well.

Just for the sake of preserving what I did see, the URL linked in the text was:

    https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf
and that now seems to have been purged from the archive.today cache, as this page says "No results":

https://archive.ph/https://schenklawfirm.com/wp-content/uplo...

reply
upvoteby mahboi4 hours ago|
parent|
[-]
You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site:

  curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \
  --compressed \
  -H 'User-Agent: [redacted]' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: [redacted but you dont need it actually]' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Sec-Fetch-Dest: document' \
  -H 'Sec-Fetch-Mode: navigate' \
  -H 'Sec-Fetch-Site: cross-site' \
  -H 'Sec-Fetch-User: ?1' \
  -H 'Priority: u=0, i' \
  -H 'TE: trailers' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' -v
reply
upvoteby opello3 hours ago|
parent|
next
[-]
Interesting. Same behavior here with a generic User-Agent and no Cookie header at all.

Response headers mention an onion-location and link to stolidityseashellshotter... but also mementoweb... pretty strange. Most generously, maybe some kind of cache poison instead of explicit bad behavior?

reply
upvoteby mahboi3 hours ago|
parent|
[-]
The page has other links that all go to archive.today. Seems like any link to a PDF causes this to happen. https://archive.ph/Y6BOX near "Download the PDF, which contains the dolls and all of the looks, here." Wonder if it's all links in general that aren't archived.

This looks like some kind of misconfiguration more than intent, or a mix, but it's still bad.

reply
upvoteby opello2 hours ago|
parent|
[-]
Wow, yeah, same two redirects for that PDF link. Geez. It'd sure be interesting to know the full cause here, otherwise it really destroys a lot of trust in the tool.

Edit: It sure does seem to be a PDF problem, these were both NYT things, but I tried a CCC talk page that had a slides link and sure enough, same behavior.

    https://archive.ph/o/n5qxb/https://fahrplan.events.ccc.de/congress/2015/Fahrplan/system/event_attachments/attachments/000/002/825/original/32c3-slides.pdf
reply
upvoteby 3 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby stordoff3 hours ago|
parent|
prev|
[-]
[dead]
reply
upvoteby stavros2 hours ago|
prev|
next
[-]
I think they meant it as in "an article archived by archive.today had malware links injected into the archived article."
reply
upvoteby 7 hours ago|
prev|
[-]
deleted
reply