edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
I presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.
To make my edit in the parent clear: HN mods have changed the title, to the exact title of the post reddit on r/seattle. This is understandable.
I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit-specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.
no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com
Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.
I wonder if the redirect target is region based, because my redirect took me to the fake Github page. I'm in the US. A fake RT article rhymes with the well established doppelganger propaganda campaign, which could rationalize why it would be region based. The irony of the doppelganger campaign being a Russian state-sponsored campaign is not lost on me.
> Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.
Well, this got on the front page of HN... Such things make even FAANG behemoths pay attention. What I mean is, who knows what happened since r/Seattle called it out.
Does some other archive, archive the archiver?
There might be a cryptographic solution for this problem, but that's far beyond my knowledge set.
Also, as the peer comment pointed out, it could be geo-scoped. You know, like a targeted attack.
The entire reason that I posted this originally is that I cannot think of a juicier userbase than HN. We all post archive.is links every single time. Given that operator's history, we are doing the link-click analogy of pasting shell commands from the web into our terminals. We should know better by now, but complacency leads to ___.
Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy extension of the aforementioned drama
Edit: Another r/seattle moderator (not the OP of the original post) has posted their technical writeup of the malware, which is detailed and definitely more in line with what we'd expect with this kind of PSA. While I stand by all criticisms of the OP moderator and their initial handling of the disclosure, you can find the details of the incident in this excellent write up: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Seems unlikely to be the case here if what one of the mods said is true:
> We verified this isn't just us or just this source (it's a link in a NYT article to a PDF anyway, about the most safe combo I can think of)
Might be able to find the article in question by looking for NYT links posted to the subreddit recently (if the presumably-deleted archive link was posted separately as a reply).
Perhaps, but it could also just be "take our word for it" devolving into more "take our extended word for it". Being prepared to make an alarming enough claim that it sparks discussion outside of the sub but being unwilling to provide evidence remains suspicious.
That suspicion becomes more grounded when the conversation with the subreddits mod regarding why the claim was made without a willingness to provide evidence looks like this:
>If you're going to make an allegation like this, it's necessary to be specific. Specifically, what is the malware, and what is the evidence that it was "injected"? This is "consult a security researcher" and "speak to the media" territory, not "mod announcement" territory.
>>No it's not. These archive sites are a legal gray area anyway. We don't have to consult anyone to decide not to allow the links. No we are not talking to the media, we're not providing research, or a proof. I'm not calling the mayor. We are reddit mods . This is purely about community management.
Is it a power trip stemming from a technical misunderstanding (archive.today exploited to deliver malware =/= archive.today attempting to deliver malware) or is it something else? In any case, reading the comments on reddit, seems like the mods are going out of their way to appeal to hysterics.
Seems like the moderators don't know what's going on and are blacklisting it out of abundance of caution. Cause whether the malware comes from the archived site or the archiver itself, it means the archiver isn't safe in a way. Which is fine. It's just ridiculous that someone is asking for details and getting ostracized as a result.
This attitude is extended when someone else asks a question about evidence, instead of replying to the question, the moderator sarcastically calls out the commentor for posting in the sub for the first time: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Its unusual and arguably suspicious because this attitude is antithetical to the stated point of the thread: To make a PSA to the community. They've also limited the comment section to only flaired users, which seems quite unusual given that this thread is ground-zero for a newsworthy claim.
Eh, still think simplest explanation is most likely here, which is that there's no secret motive, but the mods and some users over there are just dumb. I don't mean because they're nontechnical or don't have randomly specific web knowledge (one of them actually does), it's about how they responded to people.
Now that the evidence is shared and reproducible, I agree with you. This should be an embarrassing moment for the r/seattle mods, but I somewhat doubt it will be. Glad a more level headed conversation found its way to HN.
What's to be embarassed? These are busy community moderators, not whitehat hackers. They don't owe anyone a writeup of technical vulnerabilities. They owe the community clear communication of rule changes and most people expect explanation of why rules were changed, and they delivered both.
Because they made a technical claim without evidence, and when someone said this is serious and asked for details, they responded with attitude and defensiveness. They could've just said, all we know at the moment is we kept getting redirected to this malware site, so we're blocking this.
I think it's a shame that copyright laws don't allow us to host a non shady alternative to this. The only reason people use such dubious sites is that there's no other way to share a link to a news site without risking that the text will be altered later or hidden behind a paywall.
One legal way to share news stories which generate controversy is to have an AI make a summary of the article, rewording it to remove any copyright from the article (this legal trick only works when the news site in question is reporting on factual events, since facts can’t be copied as per Feist vs. Rural 1991, and I make sure that the summary has “a different sequence, pace, and setting than the original article” as per legal judgments on whether an AI summary of factual events as reported by a news source is subject to copyright).
I read through the comment thread there. There's almost no explanation of what's going on, not even the offending URL. When someone asked, he got downvoted a bunch and ridiculed, which reminds me of why I don't have a Reddit account. I don't trust archive.today because of its track record but don't trust this particular allegation either. The news is simply that a subreddit moderator blacklisted archive.today.
They've added a comment explaining what they saw, with the offending URL. It's indeed archive.today itself sending visitors to the malware download site.
No it doesn't. Aside from people here actually being curious about things, the site itself isn't designed for flame wars. It also makes it hard to get downvoted so much that your account goes into questionable standing. I'm guessing people on Reddit fix that by farming karma somewhere else, but no way am I going to bother with that.
not sure why this is downvoted. they modified their captcha so that visitors contributed to a ddos against a blog, on top of a handful of other threats, tampering of archived data, etc.
As a personal vendetta against Jani Patokallio (a Finnish cybersecurity blogger) who was trying to unmask the person who ran the site - which goes back to 2023.
I don't really care about that though, because trying to dox someone and get them killed isn't a good or moral thing to do. You could easily just not do that. You have to really go out of your way to try and hunt someone down, and at any point you could just not do it. For the targeted person to want revenge is just an inevitability.
There's been quite a lot of people still defending the site. Basically "who cares about DDoS attacks and altering archived sites' content when it allows bypassing paywalls?"
Setting my user-agent to Googlebot in a private window bypasses most paywalls just fine. Surprised at how many sites aren't checking against the published IP ranges.
Residential proxies DDoSing half the internet is standard operating procedure this decade and yet everyone still buys connected garbage and monetizes their apps this way.
Disappointing but not that surprising; it's been banned from Wikipedia for months because it was enlisting viewers' computers in a DDoS against an investigative journalist for trying to figure out who was behind it. But it's the only way I've found to access a lot of information that is otherwise lost. So, what do we do?
That's been my nagging fear about them too. Obviously it's not an option they'd want to exercise frequently, but it could be devastating to individual targets.
(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)
Yes, and archiving as a practice became popular when people noticed that media sites were beginning to edit or delete articles without listing a correction, sometimes after the story had already circulated widely. Previously, editors would usually make a note of such things.
(This is why archives that bypass paywalls are particularly important. I wish we had more options here.)
Until somebody invents a solution for bypassing paywalls at scale, they are not going away. It's like people asking "why don't AI companies release their training data".
Archive.today = archive.is - which is added via comment on a huge percentage of posts on HN.
Link to comment explaining the discovery:
https://old.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
edit: Maybe I should have titled this "claim to have discovered" as there is no external verification, and no write up. I thought I should post this in any case.
From historical posts on HN:
Archive.today is directing a DDoS attack against my blog https://news.ycombinator.com/item?id=46843805 (8 months ago, 366 points, 178 comments)
Ask HN: Weird archive.today behavior? https://news.ycombinator.com/item?id=46624740 (9 months ago, 140 points, 71 comments)
> DDoS
I presumed DDoS was used colloquially, but no, they literally added JS so every visitor made a request every 0.3 seconds to that blog server, in response to a blog article. Wholly malicious based on the reporting.
Version that doesn't require login: https://reddit.com/r/Seattle/comments/1xhf6qp/archivetoday_l...
I'm confused though, it says the site injected malware into its archived form. But the HN title says archive.today injected the malware.
You said the same thing twice. “The site” == archive.today
The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.
The archive.today site is the one injecting the malware, not the site being archived.
"It was discovered by a member of the mod team today that an article archived by archive.today had injected malware links into the archived article."
Idk, maybe this is just a typo, but grammatically this is saying the article injected the links.
Go to https://archive.ph/jXv3A#selection-5079.208-5079.212 Click on "Filed on Tuesday" and it will redirect you to a site telling you to download something.
(To be fair, that isn't the only redirect so you might need to click it a few times.)
Thanks, that's pretty much all I was looking for. Was able to reproduce but then started getting 429s.
I reproduced it too but was hoping to get a log, now all I get is 429 as well.
Just for the sake of preserving what I did see, the URL linked in the text was:
and that now seems to have been purged from the archive.today cache, as this page says "No results":https://archive.ph/https://schenklawfirm.com/wp-content/uplo...
To make my edit in the parent clear: HN mods have changed the title, to the exact title of the post reddit on r/seattle. This is understandable.
I always respect the "don't editorialize" rule, but felt that this was a special case as the post title is so sub-reddit-specific. My original post title was along the lines of "r/Seattle mods discover archive.today injecting malware, ban site.
TIL; I always thought it was part of archive.org and I never understood why people hated it. Now I get it
no one can view old.reddit.com w/o being authorized. idk if you're aware, but it lost a lot of appeal as such. what i'm saying is, folks can view reddit.com w/o logging in, but not old.reddit.com
Thanks for the reminder. Theoretically, I know this, but it’s a really hard habit for me to drop.
you used to be able to set the redesign_optout cookie to true, but that doesnt seem to work anymore as of like a day ago for me
They just demoed an entirely new version of Old Reddit at ModWorld. Same front-end but runs on the New Reddit backend.
Is that the version that looks like old reddit, but also only loads just as few comments as new reddit, and just as few nesting layers?
> Same front-end but runs on the New Reddit backend.
That's the entire reason I use old.reddit - the New Reddit backend is a pile of unreliable dung. Just like everything that is made with GraphQL.
Looks like ClickFix impersonating GitHub
https://en.wikipedia.org/wiki/ClickFix
Ahh thanks... I hadn't heard of "clickfix" before.
Hmmm... any other day I'd think that I need archive.today to get past reddit's login wall to read that.
You wouldn't have, if I could get out of the habit of posting old.reddit links.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
And, indeed, you can use archive.today to get past the login wall:
https://archive.ph/HcOq2 (This is a link to the post for this article)
(If one’s ISP can’t access archive.today, I find that Firefox’s built in free VPN can usually access them)
Or, you can use on of the various Reddit scrapers, e.g:
https://redlib.catsarch.com/r/Seattle/comments/1xhf6qp/archi...
Here’s a list of Reddit scrapers:
https://github.com/redlib-org/redlib-instances/blob/main/ins...
Personally, as scummy as archive.today is at times, I can generally trust them to have an honest archive about, say, someone’s drunk post before said drunk deletes the post.
You can just not use old.reddit.com. Regular reddit.com works without login.
Maybe this will be enough to finally rule against paywalled submissions here on HN.
Again? This happened before, if you remember this: https://www.tomshardware.com/software/search-engines/archive...
Previous HN thread:
https://news.ycombinator.com/item?id=46624740
If you're brave enough to want to see it yourself, visit https://archive.ph/jXv3A#:~:text=filed%20on%20Tuesday then click on the "Filed on Tuesday" link.
It redirected me to https://stolidityseashellshotter[.]com/ezrsb5dd1268e6f6ebaad... which then redirected me to a fake clone of RT news: https://rurtnews[.]com/
Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.
Edit: I clicked it a few more times and its redirecting me to either the fake RT or https://gullible-thanks[.]com/w5FDGi, which redirects to either https://sportshard[.]com/ or https://eatcells[.]com/land/?token=[a random string]
I had to disable uBlock Origin, since it does something to block many of these redirects.
I wonder if the redirect target is region based, because my redirect took me to the fake Github page. I'm in the US. A fake RT article rhymes with the well established doppelganger propaganda campaign, which could rationalize why it would be region based. The irony of the doppelganger campaign being a Russian state-sponsored campaign is not lost on me.
> Unlike the Reddit mods, I'm not getting redirected to the malware site, just the fake RT site.
Well, this got on the front page of HN... Such things make even FAANG behemoths pay attention. What I mean is, who knows what happened since r/Seattle called it out.
Does some other archive, archive the archiver?
There might be a cryptographic solution for this problem, but that's far beyond my knowledge set.
Also, as the peer comment pointed out, it could be geo-scoped. You know, like a targeted attack.
The entire reason that I posted this originally is that I cannot think of a juicier userbase than HN. We all post archive.is links every single time. Given that operator's history, we are doing the link-click analogy of pasting shell commands from the web into our terminals. We should know better by now, but complacency leads to ___.
Not sure what to believe here. Wouldn't it be possible to create a site that has some js embedded that is able to be aware of archive's process so that the archived page renders a different page than the original? Could that secondary page be what is trying to deliver the malware, using archive as an unwitting laundry? That matches the MO of malware delivery via other services, no? I'm baffled as to why the mods don't provide any details whatsoever. There are more links to the controversy between the blogger who sought archive's webmasters identity than details of this incident. The mods in this subreddit are doubling down on not sharing details under the guise of "not our job to be infosec". Perhaps a write up is in due time but at the moment this feels like a sketchy extension of the aforementioned drama
Edit: Another r/seattle moderator (not the OP of the original post) has posted their technical writeup of the malware, which is detailed and definitely more in line with what we'd expect with this kind of PSA. While I stand by all criticisms of the OP moderator and their initial handling of the disclosure, you can find the details of the incident in this excellent write up: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Archive.today has been caught intentionally using JS in the past to target others maliciously, so probably better not to give them the benefit of the doubt: https://www.tomshardware.com/software/search-engines/archive...
Seems unlikely to be the case here if what one of the mods said is true:
> We verified this isn't just us or just this source (it's a link in a NYT article to a PDF anyway, about the most safe combo I can think of)
Might be able to find the article in question by looking for NYT links posted to the subreddit recently (if the presumably-deleted archive link was posted separately as a reply).
Perhaps, but it could also just be "take our word for it" devolving into more "take our extended word for it". Being prepared to make an alarming enough claim that it sparks discussion outside of the sub but being unwilling to provide evidence remains suspicious.
That suspicion becomes more grounded when the conversation with the subreddits mod regarding why the claim was made without a willingness to provide evidence looks like this:
>If you're going to make an allegation like this, it's necessary to be specific. Specifically, what is the malware, and what is the evidence that it was "injected"? This is "consult a security researcher" and "speak to the media" territory, not "mod announcement" territory.
>>No it's not. These archive sites are a legal gray area anyway. We don't have to consult anyone to decide not to allow the links. No we are not talking to the media, we're not providing research, or a proof. I'm not calling the mayor. We are reddit mods . This is purely about community management.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Found it: archive[.]is/jXv3A
Originally posted here: https://www.reddit.com/r/Seattle/comments/1xh57il/removed_by...
The "filed on Tuesday" link seems to go to gullible-thanks[.]com, which redirects to random shady sites.
Reproduced on my end too.
It looks like some reddit mods on a power trip. Zero actual evidence presented.
Edit: Now there is something here: https://www.reddit.com/r/Seattle/comments/1xhf6qp/comment/19...
Is it a power trip stemming from a technical misunderstanding (archive.today exploited to deliver malware =/= archive.today attempting to deliver malware) or is it something else? In any case, reading the comments on reddit, seems like the mods are going out of their way to appeal to hysterics.
Unbelievable that the comment asking for evidence sits at -24 upvotes in that thread as of now. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Seems like the moderators don't know what's going on and are blacklisting it out of abundance of caution. Cause whether the malware comes from the archived site or the archiver itself, it means the archiver isn't safe in a way. Which is fine. It's just ridiculous that someone is asking for details and getting ostracized as a result.
I disagree with your characterization of that the mods don't know what's going on.
The moderators seem to be making it quite clear: they do know what is going on and the onus is not on them to prove it, only to notify actions have been taken in response. https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
This attitude is extended when someone else asks a question about evidence, instead of replying to the question, the moderator sarcastically calls out the commentor for posting in the sub for the first time: https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
The moderator conflates questions about evidence and requests for more details as "making demands" https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Its unusual and arguably suspicious because this attitude is antithetical to the stated point of the thread: To make a PSA to the community. They've also limited the comment section to only flaired users, which seems quite unusual given that this thread is ground-zero for a newsworthy claim.
Eh, still think simplest explanation is most likely here, which is that there's no secret motive, but the mods and some users over there are just dumb. I don't mean because they're nontechnical or don't have randomly specific web knowledge (one of them actually does), it's about how they responded to people.
Now that the evidence is shared and reproducible, I agree with you. This should be an embarrassing moment for the r/seattle mods, but I somewhat doubt it will be. Glad a more level headed conversation found its way to HN.
What's to be embarassed? These are busy community moderators, not whitehat hackers. They don't owe anyone a writeup of technical vulnerabilities. They owe the community clear communication of rule changes and most people expect explanation of why rules were changed, and they delivered both.
Because they made a technical claim without evidence, and when someone said this is serious and asked for details, they responded with attitude and defensiveness. They could've just said, all we know at the moment is we kept getting redirected to this malware site, so we're blocking this.
> This should be an embarrassing moment for the r/seattle mods, but I somewhat doubt it will be.
Imagine the shame of blocking the spread of malware before attempting to appease somebody that’s falsely accusing of you hysterics.
Every day I wake up and shake my head that another mod on the internet did something without my, the Grand Regent of Online, say so
They really need to show some evidence for this! Just this suggestion means I won't ever use it again
Wikipedia has blocked it for years. Glad everyone else is finally getting around to it.
Beware that wallhop.io sometimes forwards requests to archive.{today,is,md,ph,etc.}, e.g., for WSJ
I think it's a shame that copyright laws don't allow us to host a non shady alternative to this. The only reason people use such dubious sites is that there's no other way to share a link to a news site without risking that the text will be altered later or hidden behind a paywall.
One legal way to share news stories which generate controversy is to have an AI make a summary of the article, rewording it to remove any copyright from the article (this legal trick only works when the news site in question is reporting on factual events, since facts can’t be copied as per Feist vs. Rural 1991, and I make sure that the summary has “a different sequence, pace, and setting than the original article” as per legal judgments on whether an AI summary of factual events as reported by a news source is subject to copyright).
I read through the comment thread there. There's almost no explanation of what's going on, not even the offending URL. When someone asked, he got downvoted a bunch and ridiculed, which reminds me of why I don't have a Reddit account. I don't trust archive.today because of its track record but don't trust this particular allegation either. The news is simply that a subreddit moderator blacklisted archive.today.
And about 30 minutes ago, they switched the reddit post to flaired user only for comments.
https://www.reddit.com/r/Seattle/comments/1xhf6qp/archivetod...
Not sure if this post even qualifies to be on hacker news...its all rumors and any attempt to distill the incident to its facts is met with pushback.
They've added a comment explaining what they saw, with the offending URL. It's indeed archive.today itself sending visitors to the malware download site.
I see that now too!
> When someone asked, he got downvoted a bunch and ridiculed, which reminds me of why I don't have a Reddit account.
This happens on HN too.
No it doesn't. Aside from people here actually being curious about things, the site itself isn't designed for flame wars. It also makes it hard to get downvoted so much that your account goes into questionable standing. I'm guessing people on Reddit fix that by farming karma somewhere else, but no way am I going to bother with that.
HN isn't designed for flame wars sure, but comments regularly get down voted till hidden just for having a differing opinion.
Edit: Not being able to down vote till 300 points is a good thing tho, does prevent new accounts being created just to down vote.
The writing had been on the wall for a while. Hopefully this'll finally drive the usage of the site down.
What are the alternatives besides the IA?
https://periscope.corsfix.com/
Surprised that using visitors for DDoS attacks wasn't enough already.
not sure why this is downvoted. they modified their captcha so that visitors contributed to a ddos against a blog, on top of a handful of other threats, tampering of archived data, etc.
they are not great people.
As a personal vendetta against Jani Patokallio (a Finnish cybersecurity blogger) who was trying to unmask the person who ran the site - which goes back to 2023.
I don't really care about that though, because trying to dox someone and get them killed isn't a good or moral thing to do. You could easily just not do that. You have to really go out of your way to try and hunt someone down, and at any point you could just not do it. For the targeted person to want revenge is just an inevitability.
There's been quite a lot of people still defending the site. Basically "who cares about DDoS attacks and altering archived sites' content when it allows bypassing paywalls?"
well, yeah
Setting my user-agent to Googlebot in a private window bypasses most paywalls just fine. Surprised at how many sites aren't checking against the published IP ranges.
The few people willing to change their user-agent aren't worth the extra complexity.
Residential proxies DDoSing half the internet is standard operating procedure this decade and yet everyone still buys connected garbage and monetizes their apps this way.
Disappointing but not that surprising; it's been banned from Wikipedia for months because it was enlisting viewers' computers in a DDoS against an investigative journalist for trying to figure out who was behind it. But it's the only way I've found to access a lot of information that is otherwise lost. So, what do we do?
> investigative journalist
I think there is a confusion of blogger with a registered journalist, who must follow journalist's (ethic) rules.
for anyone interested, here's a writeup of the DDoS story: https://web.archive.org/web/20260203073744/https://gyrovague...
Weren't they also caught modifying their "archived" content?
That's been my nagging fear about them too. Obviously it's not an option they'd want to exercise frequently, but it could be devastating to individual targets.
(ofc this is a risk with the Wayback Machine, who also has a policy for honoring takedown request. But the Internet Archive's board and executives are known people with reputations)
On modifying bits, see perhaps this comment from a discussion ~8 months ago:
* https://news.ycombinator.com/item?id=47092006#47100204
* https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...
Hm, someone in the first thread mentioned a Reddit cofounder did something like this too
Yes, and archiving as a practice became popular when people noticed that media sites were beginning to edit or delete articles without listing a correction, sometimes after the story had already circulated widely. Previously, editors would usually make a note of such things.
(This is why archives that bypass paywalls are particularly important. I wish we had more options here.)
You keep using it as normal and if it tells you to copy and paste commands into your terminal you DO NOT do it?
tbh yeah, this isn't my first time visiting a sketchy website and won't be my last
But…why?
Until somebody invents a solution for bypassing paywalls at scale, they are not going away. It's like people asking "why don't AI companies release their training data".
That sucks I guess but until there’s an alternative I don’t really care.