The English-language edition of Wikipedia has moved to blacklist Archive.today, following revelations that the controversial archiving service was used to launch a distributed denial of service (DDoS) attack against a blog and had altered archived snapshots.
During discussions on whether to deprecate the site, editors discovered that Archive.today had inserted the name of blogger Jani Patokallio—who was targeted in the DDoS—into archived pages. The changes appeared linked to a dispute over Patokallio’s 2023 post that explored the site maintainer’s hidden identity.
“There is consensus to immediately deprecate archive.today, add it to the spam blacklist, and remove all links,” Wikipedia’s update stated, citing evidence of tampered archives and security risks. More than 695,000 links to Archive.today exist across 400,000 Wikipedia pages, often used to bypass paywalls. Editors were advised to replace them with alternatives such as the Internet Archive, Ghostarchive, or Megalodon.
The FBI has previously sought information on the site operator via a subpoena to domain registrar Tucows. Archive.today’s CAPTCHA page was reportedly used to direct the DDoS against Patokallio’s Gyrovague blog after he refused to remove references to the founder’s aliases. Patokallio said he welcomed Wikipedia’s decision, adding that it might encourage the Wikimedia Foundation to build its own archival service.
Emails from “Nora,” linked to Archive.today, threatened Patokallio with reputational attacks, including associating his name with AI-generated porn. Editors noted that his name had been inserted into captures of unrelated blogs, raising concerns about deliberate manipulation.
One editor wrote, “We have good reason to believe the operator has tampered with archives… If true, archive.today would have to go.” Another added that the site’s reliability was undermined, removing its only justification for use.
The Wikimedia Foundation has not ruled out further intervention, citing the seriousness of the security risks posed by Archive.today links across its platforms.
Archive.today operator accused of issuing threats
Patokallio told Ars he welcomed the Wikipedia community’s decision: “I’m glad the Wikipedia community has come to a clear consensus, and I hope this inspires the Wikimedia Foundation to look into creating its own archival service.”
After the DDoS attack began, Patokallio received emails from “Nora” of Archive.today, who threatened to publicly link his name to AI-generated porn and even create a gay dating app under his name. These threats were noted by Wikipedia editors during deliberations, who also discovered that Patokallio’s name had been inserted into some Archive.today captures.
“Honestly, I’m kind of in shock,” one editor wrote. “We have good reason to believe the operator has tampered with archived content in a way that furthers their dispute against Patokallio.”
Another editor added: “If this is true, Archive.today would have to go. Its value rests on verifiability, but that depends on archives being accurate. If tampering has occurred, the site can no longer be considered reliable.”
Evidence of altered blog snapshots
Editors highlighted one example where Patokallio’s name was inserted into an Archive.today capture of a blog post he referenced in his February 2026 account of the DDoS incident. The blog was connected to the “Nora” alias used by the Archive.today maintainer, which now appears to belong to a real person.
Patokallio wrote in an update, “It appears increasingly likely that the identity of ‘Nora’ has been appropriated from an actual person, whose only connection to Archive.today was a request to take down some content. As a courtesy, I have redacted their last name from this post.”
Evidence presented showed Archive.today had replaced Nora’s name with Patokallio’s in the blog capture. The snapshot has since been reverted to its original version. In other cases, captures displayed “Comment as: Jani Patokallio” where they had previously shown “Comment as: Nora [last name redacted].”
