archive.today CAPTCHA Loop — Evidence, Impact & Mitigation

Published February 2026 · Incident report & technical summary

Direct inspection shows the archive.today CAPTCHA page executing an automated JavaScript loop that repeatedly requests a third-party blog’s search endpoint (~300ms interval). The pattern produces sustained, DDoS-level load while the page remains open.

Observed behavior — plain English

When a visitor opens the CAPTCHA page, a tiny script repeatedly issues search requests to the target blog roughly every 300 milliseconds. That’s about three requests per second from each open CAPTCHA page; multiple visitors quickly multiply the traffic.

Technical snippet (simplified)

setInterval(function() {
  fetch("https://gyrovague.com/?s=" + Math.random().toString(36).substring(2, 3 + Math.random() * 8), {
    referrerPolicy: "no-referrer", mode: "no-cors"
  });
}, 300);

Non-technical: this loop keeps sending slightly different search queries so responses aren’t cached, forcing the target server to process each request.

Impact summary

• Each open CAPTCHA page generates ~3 requests/sec → 10,800 requests/hour.
• Multiple visitors multiply load; modest traffic can become a denial-of-service event for small servers.
• Requests use randomized query strings to defeat caching, increasing server CPU and I/O cost.

Practical effect: small/personal blogs and low-tier hosts are most at risk — sustained traffic like this can slow pages, spike resource usage, or trigger outages.

Immediate mitigation (for site owners)

• Rate-limit expensive endpoints (search, heavy queries) and return HTTP 429 after threshold.
• Apply simple query-string heuristics: ignore obviously random tiny queries server-side or serve static lightweight responses.
• Use CDN/WAF rules to block or challenge high-frequency referrers and patterns.
• Collect and preserve request logs (timestamps, UA, referrer) for abuse reporting.

Community reaction & sources

The incident and evidence have been discussed on the original investigation and in community threads. See the reporting and community analysis for screenshots, timeline, and correspondence.

Gyrovague — Original investigation Hacker News discussion Reddit — r/DataHoarder thread

Read original report Contact host / ISP