archive.today CAPTCHA Generates DDoS-Level Traffic: Evidence and Impact

Published February 2026 · Investigation · DDoS / Traffic Abuse

An investigation has confirmed that the CAPTCHA page on archive.today executes client-side code that repeatedly sends automated requests to a third-party blog every 300 milliseconds — a traffic pattern consistent with a sustained DDoS-level attack.

What is happening

When a visitor opens the archive.today CAPTCHA page, a JavaScript loop begins running automatically. This loop sends repeated search requests to a specific blog URL, using random query strings to prevent caching.

As long as the CAPTCHA page remains open, the requests continue — roughly three requests per second.

The script (plain-English explanation)

Every 300 milliseconds:
→ send a request to the blog’s search page
→ use random text so the server can’t cache it
→ repeat nonstop

For non-technical readers: this forces the target website to keep working continuously, consuming CPU, memory, and bandwidth.

Why this is serious:
Sustained traffic at this rate can slow down or completely knock offline small blogs and personal websites. In real-world impact, this matches how many DDoS attacks operate.

Public reaction

After the findings were published, the issue triggered widespread discussion on Hacker News and Reddit. Users reviewed the screenshots, verified the behavior, and debated the responsibility of third-party services whose code can directly impact other sites.

Sources & further reading

Original investigation (Gyrovague) Hacker News discussion Reddit thread (r/DataHoarder)