Link to comment explaining the discovery:
https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)
Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
https://stolidityseashellshotter.com/ezrsb5dd1268e6f6ebaad42916d5d87b8133c0816d3e7
https://gullible-thanks.com/w5FDGiI presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.
I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.
The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.
Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.
(To be fair, that isn't the only redirect so you might need to click it a few times.)
Just for the sake of preserving what I did see, the URL linked in the text was:
https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf
https://archive.ph/https://schenklawfirm.com/wp-content/uplo...
curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \
--compressed \
-H 'User-Agent: [redacted]' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-H 'Accept-Language: en-US,en;q=0.9' \
-H 'Accept-Encoding: gzip, deflate, br, zstd' \
-H 'Connection: keep-alive' \
-H 'Cookie: [redacted but you dont need it actually]' \
-H 'Upgrade-Insecure-Requests: 1' \
-H 'Sec-Fetch-Dest: document' \
-H 'Sec-Fetch-Mode: navigate' \
-H 'Sec-Fetch-Site: cross-site' \
-H 'Sec-Fetch-User: ?1' \
-H 'Priority: u=0, i' \
-H 'TE: trailers' \
-H 'Pragma: no-cache' \
-H 'Cache-Control: no-cache' -vResponse headers mention an onion-location and link to stolidityseashellshotter... but also mementoweb... pretty strange. Most generously, maybe some kind of cache poison instead of explicit bad behavior?
I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.
That's the entire reason I use old.reddit - the New Reddit backend is a pile of unreliable dung. Just like everything that is made with GraphQL.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
https://archive.ph/HcOq2 (This is a link to the post for this article)
(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)
Or, you can use on of the various Reddit scrapers, e.g:
https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...
Here’s a list of Reddit scrapers:
https://github.com/redlib-org/redlib-instances/blob/main/ins...
Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.
Previous HN thread:
It redirected me to https://stolidityseashellshotter[.]com/ezrsb5dd1268e6f6ebaad... which then redirected me to a fake clone of RT news: https://rurtnews[.]com/
Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.
Edit: I clicked it a few more times and its redirecting me to either the fake RT or https://gullible-thanks[.]com/w5FDGi, which redirects to either https://sportshard[.]com/ or https://eatcells[.]com/land/?token=[a random string]
I had to disable uBlock Origin, since it does something to block many of these redirects.
Well, this got on the front page of HN... Such things make even FAANG behemoths pay attention. What I mean is, who knows what happened since r/Seattle called it out.
Does some other archive, archive the archiver?
There might be a cryptographic solution for this problem, but that's far beyond my knowledge set.
Also, as the peer comment pointed out, it could be geo-scoped. You know, like a targeted attack.
The entire reason that I posted this originally is that I cannot think of a juicier userbase than HN. We all post archive.is links every single time. Given that operator's history, we are doing the link-click analogy of pasting shell commands from the web into our terminals. We should know better by now, but complacency leads to ___.
Edit: Another r/seattle moderator (not the OP of the original post) has posted their technical writeup of the malware, which is detailed and definitely more in line with what we'd expect with this kind of PSA. While I stand by all criticisms of the OP moderator and their initial handling of the disclosure, you can find the details of the incident in this excellent write up: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
> We verified this isn't just us or just this source (it's a link in a NYT article to a PDF anyway, about the most safe combo I can think of)
Might be able to find the article in question by looking for NYT links posted to the subreddit recently (if the presumably-deleted archive link was posted separately as a reply).
That suspicion becomes more grounded when the conversation with the subreddits mod regarding why the claim was made without a willingness to provide evidence looks like this:
>If you're going to make an allegation like this, it's necessary to be specific. Specifically, what is the malware, and what is the evidence that it was "injected"? This is "consult a security researcher" and "speak to the media" territory, not "mod announcement" territory.
>>No it's not. These archive sites are a legal gray area anyway. We don't have to consult anyone to decide not to allow the links. No we are not talking to the media, we're not providing research, or a proof. I'm not calling the mayor. We are reddit mods . This is purely about community management.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Originally posted here: https://www.reddit.com/r/Seattle/comments/1xh57il/removed_by...
The "filed on Tuesday" link seems to go to gullible-thanks[.]com, which redirects to random shady sites.
> tl;dr: Archive.today network sites sent a PDF link to an unrelated domain, even with JavaScript disabled
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Edit: Now there is something here: https://www.reddit.com/r/Seattle/comments/1xhf6qp/comment/19...
Unbelievable that the comment asking for evidence sits at -24 upvotes in that thread as of now. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
The moderators seem to be making it quite clear: they do know what is going on and the onus is not on them to prove it, only to notify actions have been taken in response. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
This attitude is extended when someone else asks a question about evidence, instead of replying to the question, the moderator sarcastically calls out the commentor for posting in the sub for the first time: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
The moderator conflates questions about evidence and requests for more details as "making demands" https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Its unusual and arguably suspicious because this attitude is antithetical to the stated point of the thread: To make a PSA to the community. They've also limited the comment section to only flaired users, which seems quite unusual given that this thread is ground-zero for a newsworthy claim.
The craziest part is the guy asking even apologized, probably cause he was getting downvoted too much and actually cares about appeasing them.
Imagine the shame of blocking the spread of malware before attempting to appease somebody that’s falsely accusing of you hysterics.
Every day I wake up and shake my head that another mod on the internet did something without my, the Grand Regent of Online, say so
they are not great people.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Not sure if this post even qualifies to be on hacker news...its all rumors and any attempt to distill the incident to its facts is met with pushback.
This happens on HN too.
Edit: Not being able to down vote till 300 points is a good thing tho, does prevent new accounts being created just to down vote.
The problem isn't really the site, it's the people. People like smashing the up and down buttons on things they agree with and unfortunately a comment's score affects where it shows up on the page.
Archive.today's /o/ endpoint itself returned the instruction to redirect, not the original source URL. We observed this in more formal testing on October 28, 2026, at approximately 07:35 UTC.
The link's actual href on the archived version of the page was:
hxxps://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-o..."
As it happens, and this is quite common, use of archive.today was not necessry
https://www.courthousenews.com/wp-content/uploads/2026/10/wa...
No "bot protection"
(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)
* https://news.ycombinator.com/item?id=47092006#47100204
* https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...
(This is why archives that bypass paywalls are particularly important. I wish we had more options here.)
I think there is a confusion of blogger with a registered journalist, who must follow journalist's (ethic) rules.