Critical risk detected
Web archiving service confirmed to have weaponized its CAPTCHA with DDoS-attack code targeting a specific blogger in early 2026. Our security stack flagged multiple threat indicators on this website. Don't enter personal information, deposit money, or download files.
Is archive.ph legit or a scam?
Web archiving service confirmed to have weaponized its CAPTCHA with DDoS-attack code targeting a specific blogger in early 2026.
These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.
Analysis Summary
MT Intelligence
Archive.ph operates as a legitimate on-demand web archiving service used widely for preserving content and bypassing paywalls. However, in January 2026, the service deliberately injected code into its CAPTCHA page that forced visitor browsers to send repeated requests to a Finnish blogger's website, turning users into unwitting participants in a targeted DDoS attack. This represents deliberate malicious conduct by the operator, not a security flaw or accident. The operator remains anonymous and is currently the subject of an FBI criminal investigation following a subpoena to the domain registrar. While the service has legitimate use cases and some users praise its technical capabilities, the confirmed weaponization of the CAPTCHA system for a personal dispute crosses into malicious territory.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →
Visual Screenshot Analysis
We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.
Visual red flags detected in the screenshot
We could not capture a fully-rendered screenshot of this page; visual analysis is inconclusive.
What our vision model saw
1 signalScreenshot incomplete — site may be slow to render
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for archive.ph, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- archive.ph is one of several mirror domains (alongside archive.today, archive.is, archive.li etc.) for a popular on-demand web archiving service launched in 2012 that captures snapshots including JavaScript-rendered content and screenshots.
- The service is widely used to bypass paywalls, preserve ephemeral content, and in academic/fact-checking contexts; praised on HN and Reddit for better fidelity than Wayback Machine in some cases.
- Operator remains anonymous; WHOIS data points to likely pseudonymous 'Denis Petrov' in Czech Republic; speculated to be a single individual possibly based in Russia; privately funded with donations.
- In Oct/Nov 2025, FBI issued subpoena to registrar Tucows seeking owner identification and records as part of an undisclosed criminal investigation.
- In Jan 2026, the service was reported to have injected code in its CAPTCHA that turned visitor browsers into participants in a targeted DDoS attack against a blogger (Gyrovague/Patokallio) with whom it had a personal dispute; led to English
- Service has faced blocks/bans in China (since 2019), Russia, disputes with Cloudflare DNS, occasional downtime reports, and a 2025 Malwarebytes IP-range block (later whitelisted after review).
- No traditional consumer scam, phishing, or malware distribution reports found; one security checker (Scamvoid) rates it potentially safe with no blocklist hits. However, the CAPTCHA abuse constitutes malicious behavior.
- Wikipedia / News reportsopen
"In January 2026, archive.today added code into its CAPTCHA page to send repeated requests causing visitors to unwittingly contribute to a DDoS attack targeted at a Finnish blogger."
- Reddit r/antivirusopen
"Archive.today added malware in their Captcha... the site forced their browsers to unknowingly flood websites with repeated search requests."
- HackReadopen
"The FBI has issued a federal subpoena to domain registrar Tucows... to unmask the anonymous operator of Archive.ph... subject of an undisclosed criminal investigation."
- Hacker Newsopen
"archive.ph does a better job of preserving the page as is (it also takes a screenshot) compared to internet archive which can be flaky at best... much faster at searching."
- Scamvoidopen
"The site seems safe according to this report: The site is not detected by any blocklist engine... Potentially Safe."
- Wikipediaopen
"archive.today is a web archiving website that saves snapshots on demand. It has support for JavaScript-heavy sites such as Google Maps and X."
Multiple sources confirm that in January 2026, archive.ph injected malicious code into its CAPTCHA page that forced visitor browsers to send repeated requests to a Finnish blogger's website, turning users into unwitting participants in a targeted DDoS attack. Reports appeared on Wikipedia, Reddit's r/antivirus community, and HackRead. The FBI issued a subpoena to domain registrar Tucows in 2025 seeking to unmask the anonymous operator as part of an undisclosed criminal investigation. On the positive side, Hacker News users praise the service's technical capabilities for web archiving, and one independent security checker (Scamvoid) reported no blocklist detections. However, the confirmed weaponization of the CAPTCHA system for a personal dispute outweighs the legitimate archiving functionality.
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Domain & Encryption
Redirect Chain
- 1302http://archive.ph/
- 2429https://archive.ph/
Server Reputation
Scam-Type Likelihood
1 scam-type patterns detected
0 of 13 categories showed signals
We check every URL against 13 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.
- AI analyst tagged this as malware / drive-by / cracked app.
0 of 13 categories showed signals
We check every URL against 13 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.
- AI analyst tagged this as malware / drive-by / cracked app.
Malware distribution detected
Signals suggest this page may deliver malicious files or exploit the browser.
- Do not interact with archive.ph
Do not enter credentials, deposit money, download files, or install browser extensions from this site.
- If you downloaded or ran a file from here
Disconnect the device from the internet, run a full scan with a reputable antivirus (Malwarebytes, ESET, Bitdefender), and consider a second-opinion scanner. Change passwords on any account you used from the device afterwards — ideally from a different device.
- OpenGet free cleanup help
MalwareTips has a dedicated malware-removal team who walk you through cleanup one-on-one.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Safety FAQ
Common questions about this site, answered from the scan data on this page. These are auto-generated — not hand-written — so they always match the underlying report.
- Our automated security review flags archive.ph as dangerous. Multiple threat indicators were detected — treat the site as a scam until proven otherwise.
- No — archive.ph scored 25/100 on our trust scale. We detected active threat indicators, so we recommend avoiding the site entirely.
- Yes. archive.ph presents a valid TLSv1.2 certificate issued by Let's Encrypt · YE2, expiring in 88 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
- No. archive.ph is not currently listed on the major browser blocklist feeds that modern browsers use.
- archive.ph resolves to an IP operated by Skhron OU in SE (usage type: Data Center/Web Hosting/Transit). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- We cache results for 24 hours. Signed-in MalwareTips members can trigger a manual rescan at any time using the "Rescan" button on the report page, which re-runs every check from scratch and refreshes this page.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.