Hacker News

points by consumer451 1 day ago | 0 comments

Archive.today = archive.is - which is added via comment on a huge percentage of posts on HN.

Link to comment explaining the discovery:

https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.

[–] shagie 1 day ago

From historical posts on HN:

Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)

Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)

[–] no-name-here 1 day ago

> DDoS

I presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.

[–] consumer451 1 day ago

For everyone's information: r/Seattle's mod team has stickied this technical debrief in response to this HN post. We are the "external site" that is kinda brigading them.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

[–] opello 1 day ago

The only thing I'd add is that I see redirects to at least two domains:

    https://stolidityseashellshotter.com/ezrsb5dd1268e6f6ebaad42916d5d87b8133c0816d3e7
    https://gullible-thanks.com/w5FDGi

[–] Vaushite 1 day ago

Wasn't the "victim" trying to get the "attacker" life in prison for the crime of archiving public information?

[–] neuronexmachina 1 day ago

What is this referring to? I tried to find when Jani Patokallio tried to get the people behind archive.today imprisoned, but can't find anything.

[–] oytis 1 day ago

Yeah, everyone is freaking out about the (not very efficient as I can see) DDoS attempt, but it was a response to a totally unprovoked attempt to deanon the maintainer which could cost them freedom at least - and us all the only more or less reliable paywall remover.

[–] dspillett 1 day ago

I tend to think that being an arsehole when provoke is still being an arsehole. There are other ways to defend against such an attack than sending the boys¹ round to play bully², that was no better than throwing bricks through all their windows and I assume that we are civilised enough here that wouldn't condone that.

I particularly dislike the fact that I was, unbeknownst to me at the time, was coopted as part of that brigade of brick throwers.

--------

[1] a significant chuck of the internet

[2] beat up his online resources

[–] Analemma_ 1 day ago

I don't really care about the motivation? Malware is malware.

[–] consumer451 1 day ago

To make my edit in the parent clear: HN mods have changed the title, to the exact title of the post reddit on r/seattle. This is understandable.

I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.

[–] mahboi 1 day ago

Version that doesn't require login: https://reddit.com/r/Seattle/comments/1xhf6qp/archivetoday_l...

I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.

[–] dpark 1 day ago

You said the same thing twice. “The site” == archive.today

The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.

[–] LoganDark 1 day ago

The archive.today site is the one injecting the malware, not the site being archived.

[–] mahboi 1 day ago

"It was discovered by a member of the mod team today that an article archived by archive.today had injected malware links into the archived article."

Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.

[–] k00shball 1 day ago

Go to https://archive.ph/jXv3A#selection-5079.208-5079.212 Click on "Filed on Tuesday" and it will redirect you to a site telling you to download something.

(To be fair, that isn't the only redirect so you might need to click it a few times.)

[–] deepfriedrice 1 day ago

It immediately stands out that that link is to a /wp-content URL. AKA wordpress. AKA PHP. AKA very recently vulnerable (and perhaps still)...

Whereas other links (e.g. the immediate next one to arxiv) seem unaffected.

edit: That was a red herring. It seems to redirect all .pdf links I try that don't point to a valid snapshot. Very interesting.

[–] mahboi 1 day ago

Thanks, that's pretty much all I was looking for. Was able to reproduce but then started getting 429s.

[–] opello 1 day ago

I reproduced it too but was hoping to get a log, now all I get is 429 as well.

Just for the sake of preserving what I did see, the URL linked in the text was:

    https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf

and that now seems to have been purged from the archive.today cache, as this page says "No results":

https://archive.ph/https://schenklawfirm.com/wp-content/uplo...

[–] mahboi 1 day ago

You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site:

  curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \
  --compressed \
  -H 'User-Agent: [redacted]' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Connection: keep-alive' \
  -H 'Cookie: [redacted but you dont need it actually]' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'Sec-Fetch-Dest: document' \
  -H 'Sec-Fetch-Mode: navigate' \
  -H 'Sec-Fetch-Site: cross-site' \
  -H 'Sec-Fetch-User: ?1' \
  -H 'Priority: u=0, i' \
  -H 'TE: trailers' \
  -H 'Pragma: no-cache' \
  -H 'Cache-Control: no-cache' -v

[–] stavros 1 day ago

I think they meant it as in "an article archived by archive.today had malware links injected into the archived article."

[–] vadansky 1 day ago

TIL; I always thought it was part of archive.org and I never understood why people hated it. Now I get it

[–] grimgrin 1 day ago

no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com

[–] RunSet 1 day ago

Lemmy is shaping up to be the reddit replacement.

And it is federated so when the biggest Lemmy instance starts to suck, Lemmy can be the Lemmy replacement, too.

I understand that mentioning it on popular subreddits is verboten.

https://lemmy.world/

[–] Vaushite 17 hours ago

The biggest Lemmy instance already sucks. Try lemmy.dbzer0.com instead.

[–] ranger_danger 13 hours ago

My experience with Lemmy is that it is much worse than reddit in terms of the number of people with cosmically inflated god-complex egos posting baseless accusations and wild misinformation as dogma with impunity. Then the mods punish anyone who calls them out on it... they seem to operate on extremely arbitrary and misguided rules: https://a.imagem.app/G3R9xb.png

Many servers defederate from each other regularly, making it very much a "which wind would you like to piss into" situation where you have no idea who (if anyone) is even seeing your messages.

[–] consumer451 1 day ago

Thanks for the reminder. Theoretically, I know this, but it’s a really hard habit for me to drop.

[–] Akronymus 1 day ago

you used to be able to set the redesign_optout cookie to true, but that doesnt seem to work anymore as of like a day ago for me

[–] qingcharles 1 day ago

They just demoed an entirely new version of Old Reddit at ModWorld. Same front-end but runs on the New Reddit backend.

[–] kuschku 1 day ago

Is that the version that looks like old reddit, but also only loads just as few comments as new reddit, and just as few nesting layers?

[–] qingcharles 10 hours ago

I believe the new, new version of old Reddit that was demo'd last week is not live just yet.

[–] reddalo 1 day ago

The fact that only some comments are loaded it's so infuriating. It's the main reason I stopped using Reddit altogether.

[–] mschuster91 1 day ago

> Same front-end but runs on the New Reddit backend.

That's the entire reason I use old.reddit - the New Reddit backend is a pile of unreliable dung. Just like everything that is made with GraphQL.

[–] arprocter 1 day ago

Looks like ClickFix impersonating GitHub

https://en.wikipedia.org/wiki/ClickFix

[–] k00shball 1 day ago

Ahh thanks... I hadn't heard of "clickfix" before.

[–] paulpauper 1 day ago

it's the worst possible malware. very deceptive

[–] abeyer 1 day ago

Hmmm... any other day I'd think that I need archive.today to get past reddit's login wall to read that.

[–] consumer451 1 day ago

You wouldn't have, if I could get out of the habit of posting old.reddit links.

https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...

[–] strenholme 1 day ago

And, indeed, you can use archive.today to get past the login wall:

https://archive.ph/HcOq2 (This is a link to the post for this article)

(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)

Or, you can use on of the various Reddit scrapers, e.g:

https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...

Here’s a list of Reddit scrapers:

https://github.com/redlib-org/redlib-instances/blob/main/ins...

Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.

[–] mahboi 1 day ago

You can just not use old.reddit.com. Regular reddit.com works without login.

[–] abeyer 1 day ago

Old still exists and gets heavy use a decade or so later exactly because regular reddit just doesn't work at all, even when you're logged in.

But even aside from opinions on their UX, they're aggressively experimenting with the login more... Even on the new UI I now semi-regularly see that I can read the initial post and one or two comments but as soon as I scroll past or try to expand a comment thread get a login prompt.

[–] mahboi 1 day ago

I dunno, used the regular one and it worked fine. Probably not for long.

[–] drusepth 1 day ago

Maybe this will be enough to finally rule against paywalled submissions here on HN.

[–] paulpauper 1 day ago

that is almost everything nowadays though. and not all paywall sites give paywalls all the time