9 ms·
Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2
- winkelmann 6mo ago"archive.today is currently categorized as: * CIPA Filter * Reference * Command and Control & Botnet * DNS Tunneling" Ditto for their other domains like archive.is and archive.ph Example DoH request: $ curl -s "https://1.1.1.2/dns-query?name=archive.is&type=A https://1.1.1.2/dns-query?name=archive.is&type=A" -H "accept: application/dns-json" {"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"archive.is","type":1}],"Answer":[{"name":"archive.is","type":1,"TTL":60,"data":"0.0.0.0"}],"Comment":["EDE(16): Censored"]} --- Relevant HN discussions: https://news.ycombinator.com/item?id=46843805 https://news.ycombinator.com/item?id=46843805 "Archive.today is directing a DDoS attack against my blog" https://news.ycombinator.com/item?id=47092006 https://news.ycombinator.com/item?id=47092006 "Wikipedia deprecates Archive.today, starts removing archive links" https://news.ycombinator.com/item?id=46624740 https://news.ycombinator.com/item?id=46624740 "Ask HN: Weird archive.today behavior?" - Post about the script used to execute the denial-of-service attack Wikipedia page on deprecating and replacing archive.today links: https://en.wikipedia.org/wiki/Wikipedia:Archive.today_guidance https://en.wikipedia.org/wiki/Wikipedia:Archive.today_guidan...
- simonw 6mo agoThanks for that, I didn't know about that API - which it turns out has open CORS headers so you can call it from JavaScript. I now have my dream DNS lookup web tool! https://tools.simonwillison.net/dns#d=news.ycombinator.com&t=A&r=1.1.1.1&all=1 https://tools.simonwillison.net/dns#d=news.ycombinator.com&t...
- ignoramous 6mo agohttps://dohjs.org/ https://dohjs.org/ is pretty nifty. Also: https://dnscheck.tools/ https://dnscheck.tools/
- charcircuit 6mo agoWhen the heat dies down, hopefully this flag gets removed.
- dydgbxx 6mo agoWhy? It’s accurate and if the owner has chosen to do this for months now, why should we ever trust they won’t again? Nobody should ever use that site and every optional filter should block them.
- JasonADrury 6mo ago[flagged]
- winkelmann 6mo agoThere's probably a worthwhile discussion to be had about what it takes for a site in this situation to be removed from blocklists. An apology? Surrender to authorities? Halting the malicious activity for a certain period of time? Regardless, another user reports the attack is still ongoing[1], so this isn't a discussion that's going to happen about archive.today anytime soon. [1] https://news.ycombinator.com/item?id=47474777 https://news.ycombinator.com/item?id=47474777
- ryandrake 6mo agoI suppose “evidence that the site’s leadership has permanently changed” would convince me. Whoever decided to put in the code that causes visitors to DDOS someone should never be running a web site again.
- razingeden 6mo agoCloudflare dns has gone back and forth on whether it wants to resolve them since 2019. It’s taken that away and restored it again (intentionally? mistake?) at least four times. The c&c/botnet designation would seem to be new though.
- altairprime 6mo agoIntentionally, I believe? archive.today iirc has explicitly blocking Cloudflare from resolving them at various times over the years due to Cloudflare DNS withholding requesting-user PII (ip address) in DNS lookups. Looking forward to when Google Safe Browsing adds their domains as unsafe, as that ripples to Chrome and Firefox users.
- akerl_ 6mo agoHave they? The thing I remember previously was archive.is, and it wasn’t a block, archive.is was serving intentionally wrong responses to queries from cloudflare’s resolvers. This is notably not a change to how 1.1.1.1 works, it’s specifically their filtered resolution product. https://news.ycombinator.com/item?id=19828702 https://news.ycombinator.com/item?id=19828702
- razingeden 6mo agoThank you. And all. It’s too late to edit my comment but the ones in this vein checked out and I stand corrected
- winkelmann 6mo agoAs far as I am aware, all previous issues with archive.today and Cloudflare were on account of archive.today taking measures to stop Cloudflare's DNS from correctly resolving their domains, not the other way around. The current situation is due to Cloudflare flagging archive.today's domains for malicious activity, Cloudflare actually still resolves the domains on their normal 1.1.1.1 DNS, but 1.1.1.2 ("No Malware") now refuses. Exactly why they decided to flag their domains now, over a month after the denial-of-service accusations came out, is unclear, maybe someone here has more information.
- _moof 6mo agoGood. You don't get to use my computer for a DDoS. I don't care why the DDoS was happening. I wasn't asked, and that's a serious breach of trust.
- rdevilla 6mo ago[flagged]
- winkelmann 6mo agoCall me naive, but I still believe that people generally disapprove of their internet connection being abused to conduct cyber-attacks.
- rdevilla 6mo ago[flagged]
- longislandguido 6mo agoBreach of trust by a site whose unstated primary purpose is bypassing paywalls and ripping off content? 20 years ago during the P2P heyday this was assumed to come with the territory. Play with fire and you could get burned. If you walk into a seedy brothel in the developing world, your first thought should be "I might get drugged and robbed here" and not what you're going to type in the Yelp review later about their lack of ethics.
- celdon25 6mo agoI always thought that mainstream media sites with paywalls were pretty far down there in the tier list of websites though. Not sure if this analogy lands unless irony was the goal.
- jojomodding 6mo agoI trust websites not to involve me in crime. I trust news websites to tell me the news. I trust archive websites to give me old versions of websites. I trust paywall circumvention websites to circumvent paywalls. What I do not see is the irony you insinuate in your post. It is not immoral to charge people for content, nor does that make you less credible. (It might even make you more credible since you now earn money by having happy customers instead of serving more ads.) Some news sources are not trustworthy but that's independent of there being a paywall.
- stuffoverflow 6mo agoArchive.today's attack on https://gyrovague.com https://gyrovague.com is still on-going btw. It started just over two months ago. Some IPs get through normally but for example finnish residential IPs get stuck on endless captchas. The JS snippet that starts spamming gyrovague appears after solving the first captcha.
- winkelmann 6mo agoI'm not a web developer, but I've picked up some bits of knowledge here and there, mostly from troubleshooting issues I encounter while using websites. I know there are a number of headers used to control cross-site access to websites, and the linked blog post shows archive.today's denial-of-service script sending random queries to the site's search function. Shouldn't there be a way to prevent those from running when they're requested from within a third-party site?
- deleted 6mo ago[deleted]
- JasonADrury 6mo ago[flagged]
- throwingcookies 6mo ago> The blog is still online and only exists as a part of a harassment campaign targeting archive.today The blog has a lot of more posts on random topics. Why do you imply that the owner of the bloh is part of a harassment campaign and "only" that is the reason for this years old blog to exist?
- JasonADrury 6mo agoBecause all the content in the past 4+ years is about archive.today?
- 6mo ago
- 3842056935870 6mo ago[dead]
- deleted 6mo ago[deleted]
- andor 6mo ago[flagged]
- PeterStuer 6mo agoOtoh, without archive.today a substantial % of HN posts would be unreadable for nearly all of the audience.
- henearkr 6mo agoI doubt it. You may have mixed it up with archive.org.
- JasonADrury 6mo agoI suggest you double-check that. Archive.today/archive.is is the one which bypasses paywalls and makes unreadable content readable, not archive.org
- henearkr 6mo agoAh! You may well be right. Thanks. That's bad then, to depend on that for paywall bypass... I hope very much that the situation evolves into a more satisfactory one.
- baobabKoodaa 6mo agoArchive.is links have not worked for me for over a year. Infinite captcha loop.
- DanielHall 6mo ago[dead]
- breppp 6mo agoWhile I fully support this instance, I wonder what else Cloudflare has set to "Censored", apart for the obvious CSAM
- Kwpolska 6mo ago1.1.1.2 is their malware-blocking DNS, and 1.1.1.3 is their parental-controls DNS. If you want an unfiltered DNS, use 1.1.1.1 - which resolves archive.today just fine, although archive.today itself refuses to work on Cloudlfare DNS.
- surgical_fire 6mo agoI have no idea why anyone would use Cloudflare DNS, much less trust their more filtered versions.
- saaaaaam 6mo agoI use cloudflare DNS because it’s faster. But should I worry, having read your comment? What is the downside to using it? What would you recommend instead?
- surgical_fire 6mo agoQuad9. Many years ago I used Cloudflare, and more than once I had issues with them blocking websites I wanted to access. I absolutely despise that. I want my DNS to resolve domain names, nothing else. For blocking things I have Pi-Hole, which is under my control for that reason. I can blacklist or whitelist addresses to my needs, not to the whims of a corporation that wants to play gatekeeper to what I can browse.
- akerl_ 6mo agoSo… why not use 1.1.1.1, cloudflare’s resolver that does not block resolution? 1.1.1.2 and .3 are explicitly offered with filtered responses.
- rollulus 6mo agoI think there are two angles to look at this. Yes, there’s the attack on the weblog. But there’s also pressure on archive.today, e.g. an FBI investigation [1] and some entity using fictitious CSAM allegations [2]. [1]: https://arstechnica.com/tech-policy/2025/11/fbi-subpoena-tries-to-unmask-mysterious-founder-of-archive-today/ https://arstechnica.com/tech-policy/2025/11/fbi-subpoena-tri... [2]: https://adguard-dns.io/en/blog/archive-today-adguard-dns-block-demand.html https://adguard-dns.io/en/blog/archive-today-adguard-dns-blo...
- JasonADrury 6mo agoJani Patokallio who runs gyrovague.com published a blog post attempting to dox the owner of archive.today. Jani justifies his doxing as follows "I found it curious that we know so little about this widely-used service, so I dug into it" [1] Archive.today on the other hand is a charitable archival project offered to the public for free. The operator of Archive.today risks significant legal liability, but still offers this service for free. [1]: https://gyrovague.com/2026/02/01/archive-today-is-directing-a-ddos-attack-against-my-blog/#:~:text=I%20found%20it%20curious%20that%20we%20know%20so%20little%20about%20this%20widely%2Dused%20service%2C%20so%20I%20dug%20into%20it%2C https://gyrovague.com/2026/02/01/archive-today-is-directing-... It's weird to see people getting fixated on the DDoS, which is obviously far less nasty than actually attempting to dox someone. The only credible reason for Jani to publish something like this is if he desires to cause physical harm to the operator of archive.today Or are we just looking at an unhinged fan stalking their favorite online celebrity? People were critical of the Banksy piece, but this is much nastier. At least Banksy is a huge business, archive.today does not even make money.
- woopsn 6mo agoAs of now the site is in-fact a C&C/botnet. Cloudflare naturally fixates on such risks, not speech (generally). The basic purpose of 1.1.1.2 is to not wind up part of botnet.
- viktoresku 6mo agoCloudflare strikes back for AT's blocking 1.1.1.1 for years. How did 1.1.1.2 managed to work when 1.1.1.1 did not?
- ddactic 6mo ago[dead]
- f-serif 6mo agoA bit context if you are confused why Public DNS server blocking websites. 1.1.1.2 is Malware blocking DNS server similar to AdBlock DNS server. It is not 1.1.1.1 and 1.0.0.1 Here is the DDoS context https://gyrovague.com https://gyrovague.com
- swrobel 6mo agoFor some reason I thought 1.1.1.1/1.0.0.1 already wouldn’t resolve archive.[today|is|ph] anyway
- roywiggins 6mo agoSort of: https://jarv.is/notes/cloudflare-dns-archive-is-blocked https://jarv.is/notes/cloudflare-dns-archive-is-blocked
- apaprocki 6mo agoAnd for parents: 1.1.1.3 blocks adult content :)
- TacticalCoder 6mo agoYeah I only ever use 1.1.1.3. Of note is that 1.1.1.3 is like 1.1.1.2 but with know adult sites also blocked, in addition to malware.
- chloecv 6mo ago[dead]
- algolint 6mo ago[flagged]
- bunbun69 6mo agoGood. What archive.today is doing is illegal
- jeremie_strand 6mo ago[flagged]
- winkelmann 6mo agoI was wondering about this too. I thought that it could be about it being possible to use archive.today to view sites otherwise blocked via DNS, but web.archive.org[1] doesn't have that flag, so it must be something else. [1] https://radar.cloudflare.com/domains/domain/web.archive.org https://radar.cloudflare.com/domains/domain/web.archive.org
- kmfrk 6mo agoWhat a crazy timeline this has been. (1) May 04 2019: "Tell HN: Archive.is inaccessible via Cloudflare DNS (1.1.1.1)" [https://news.ycombinator.com/item?id=19828317 https://news.ycombinator.com/item?id=19828317] eastdakota on May 4, 2019 on: Tell HN: Archive.is inaccessible via Cloudflare DNS... [Via https://news.ycombinator.com/item?id=19828702] We don’t block archive.is or any other domain via 1.1.1.1. Doing so, we believe, would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. Archive.is’s authoritative DNS servers return bad results to 1.1.1.1 when we query them. I’ve proposed we just fix it on our end but our team, quite rightly, said that too would violate the integrity of DNS and the privacy and security promises we made to our users when we launched the service. The archive.is owner has explained that he returns bad results to us because we don’t pass along the EDNS subnet information. This information leaks information about a requester’s IP and, in turn, sacrifices the privacy of users. This is especially problematic as we work to encrypt more DNS traffic since the request from Resolver to Authoritative DNS is typically unencrypted. We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1. EDNS IP subsets can be used to better geolocate responses for services that use DNS-based load balancing. However, 1.1.1.1 is delivered across Cloudflare’s entire network that today spans 180 cities. We publish the geolocation information of the IPs that we query from. That allows any network with less density than we have to properly return DNS-targeted results. For a relatively small operator like archive.is, there would be no loss in geo load balancing fidelity relying on the location of the Cloudflare PoP in lieu of EDNS IP subnets. We are working with the small number of networks with a higher network/ISP density than Cloudflare (e.g., Netflix, Facebook, Google/YouTube) to come up with an EDNS IP Subnet alternative that gets them the information they need for geolocation targeting without risking user privacy and security. Those conversations have been productive and are ongoing. If archive.is has suggestions along these lines, we’d be happy to consider them. (2) Sep 11 2021: "Does Cloudflare's 1.1.1.1 DNS Block Archive.is? (2019) (jarv.is)" [https://news.ycombinator.com/item?id=28495204 https://news.ycombinator.com/item?id=28495204]
- zamadatix 6mo agoThe 1.1.1.1 referred to in the above is Cloudflare's main resolver, 1.1.1.2 & 1.1.1.3 are for those intentionally looking for malware and content blocking.
- ck2 6mo agoquad9 dnscrypt for the win https://quad9.net/service/service-addresses-and-features/ https://quad9.net/service/service-addresses-and-features/ Secured w/ECS: Malware blocking, DNSSEC Validation, ECS enabled IPv4 9.9.9.11 149.112.112.11 IPv6 2620:fe::11 2620:fe::fe:11 HTTPS https://dns11.quad9.net/dns-query TLS tls://dns11.quad9.net
- 1vuio0pswjnm7 6mo agoSome time ago, probably at least a year, likely more, I read a blog post by someone working for Google in Europe who loved using Archive.today and out of curiosity tried to determine who was running it. In the end he gave up, offered to buy the operator a beer or something like that, but if I recall correctly he went to even greater lengths in his research than the blogger discussed in this thread I wish I could find it
- sillysaurusx 6mo agohttps://gyrovague.com/2023/08/05/archive-today-on-the-trail-of-the-mysterious-guerrilla-archivist-of-the-internet/ https://gyrovague.com/2023/08/05/archive-today-on-the-trail-... Sparked a controversial subthread elsewhere here. I don’t think this counts as doxxing, but some people apparently see it that way. It was an entertaining read though.
- acejam 6mo agoIt amazes me that people still use and recommend Cloudflare's DNS servers for resolution. Cloudflare DNS does not support EDNS Client Subnet. As a result, DNS queries resolved by their service are likely to return IP addresses for many CDNs that are physically farther away from you, leading to a slower internet browsing and viewing experience. Sacrificing performance for a faster lookup time makes no sense in 2026. This is the one area where I continue to use Google DNS as it just works. Use anything but Cloudflare in this case, please. Parent pro-tip: Next time the iPad is having Bluey episode playback issues, check to see if you're actually using Cloudflare DNS.
- deleted 6mo ago[deleted]
- tredre3 6mo agoWithout ECS, the CDN will default to the closest one to the resolver, and cloudflare has resolvers in all major cities. Given that the vast majority of us live in or near a major city, it means that your vaguely gloom and doom commentary doesn't apply. If you live in the boondocks or if CDN matching misbehaves for some reason, by all means run benchmarks! But all other things being equal, Cloudflare's privacy policy is better than Google's.
- acejam 6mo agoI'm near a major city. Your comments unfortunately do not align with my experience, nor the experience of several people that I know. Testing has confirmed this.
- GTP 6mo agoI reported the miscalssification, you can do it as well from the linked page. Edit: reading some comments here seems that I was too fast, and that the story is much more complicated. Having just the Cloudflare page as a context, I assumed the news were a miscalssification. Could someone share more context on what is going on here?
- heraldgeezer 6mo ago[flagged]
- Permit 6mo agoThe owner of archive.is modifies contents of articles already so I hope you’re not actually depending on it as an archive. It’s a paywall escape hatch not an archive site.
- anonym29 6mo agoI, for one, completely trust Cloudflare on this one. The guys running a MiTM attack on a substantial chunk of all global internet traffic, and working tirelessly to ensure billions of people behind CGNAT in the global south can't access the free and open web are the premiere experts on malicious, predatory, harmful internet-scale network behavior, after all.
- lagniappe 6mo agoCloudflare considered harmful
- landr0id 6mo agoThey aren’t wrong. They’re literally using scripts on their site in an attempt to DDoS a blog which (partially?) de-anonymized the archive.today operator.
- fckmodsyesu 6mo agoThis involves nation state actors, you can't trust anything said here.
- pamcake 6mo agoLooks like there are several fresh data points for those tracking personas related to .today operations on display in this very thread... It's either sockpuppets or evidence of larger op
- coretx 6mo agoCloudflare is a clandestine intelligence operation run by a rogue nation. Just like spamhaus and many other firms that have ridiculous amounts of illegitimate and unchecked power.
- sc68cal 6mo agoSpamhaus only has this power because administrators opt-in to their service. It is useful, so people use it.
- Rithan 6mo ago[dead]
- arjun20 6mo ago[dead]
- arjun20 6mo ago[dead]
- 1o1o1o1o1 6mo agoClever way to deplatform a site they don't like.