Comment by mahboi 2 hours ago Thanks, that's pretty much all I was looking for. Was able to reproduce but then started getting 429s. 2 comments mahboi Reply opello 1 hour ago I reproduced it too but was hoping to get a log, now all I get is 429 as well.Just for the sake of preserving what I did see, the URL linked in the text was: https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf and that now seems to have been purged from the archive.today cache, as this page says "No results":https://archive.ph/https://schenklawfirm.com/wp-content/uplo... mahboi 19 minutes ago You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site: curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \ --compressed \ -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:158.0) Gecko/20100101 Firefox/158.0' \ -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \ -H 'Accept-Language: en-US,en;q=0.9' \ -H 'Accept-Encoding: gzip, deflate, br, zstd' \ -H 'Connection: keep-alive' \ -H 'Cookie: [redacted]' \ -H 'Upgrade-Insecure-Requests: 1' \ -H 'Sec-Fetch-Dest: document' \ -H 'Sec-Fetch-Mode: navigate' \ -H 'Sec-Fetch-Site: cross-site' \ -H 'Sec-Fetch-User: ?1' \ -H 'Priority: u=0, i' \ -H 'TE: trailers' \ -H 'Pragma: no-cache' \ -H 'Cache-Control: no-cache'
opello 1 hour ago I reproduced it too but was hoping to get a log, now all I get is 429 as well.Just for the sake of preserving what I did see, the URL linked in the text was: https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf and that now seems to have been purged from the archive.today cache, as this page says "No results":https://archive.ph/https://schenklawfirm.com/wp-content/uplo... mahboi 19 minutes ago You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site: curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \ --compressed \ -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:158.0) Gecko/20100101 Firefox/158.0' \ -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \ -H 'Accept-Language: en-US,en;q=0.9' \ -H 'Accept-Encoding: gzip, deflate, br, zstd' \ -H 'Connection: keep-alive' \ -H 'Cookie: [redacted]' \ -H 'Upgrade-Insecure-Requests: 1' \ -H 'Sec-Fetch-Dest: document' \ -H 'Sec-Fetch-Mode: navigate' \ -H 'Sec-Fetch-Site: cross-site' \ -H 'Sec-Fetch-User: ?1' \ -H 'Priority: u=0, i' \ -H 'TE: trailers' \ -H 'Pragma: no-cache' \ -H 'Cache-Control: no-cache'
mahboi 19 minutes ago You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site: curl 'https://archive.ph/o/jXv3A/https://schenklawfirm.com/wp-content/uploads/2026/10/wan-v-openai-complaint.pdf' \ --compressed \ -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:158.0) Gecko/20100101 Firefox/158.0' \ -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \ -H 'Accept-Language: en-US,en;q=0.9' \ -H 'Accept-Encoding: gzip, deflate, br, zstd' \ -H 'Connection: keep-alive' \ -H 'Cookie: [redacted]' \ -H 'Upgrade-Insecure-Requests: 1' \ -H 'Sec-Fetch-Dest: document' \ -H 'Sec-Fetch-Mode: navigate' \ -H 'Sec-Fetch-Site: cross-site' \ -H 'Sec-Fetch-User: ?1' \ -H 'Priority: u=0, i' \ -H 'TE: trailers' \ -H 'Pragma: no-cache' \ -H 'Cache-Control: no-cache'
I reproduced it too but was hoping to get a log, now all I get is 429 as well.
Just for the sake of preserving what I did see, the URL linked in the text was:
and that now seems to have been purged from the archive.today cache, as this page says "No results":
https://archive.ph/https://schenklawfirm.com/wp-content/uplo...
You get 429 if you visit the link directly. Not sure what mechanism is used to tell that, doesn't seem to be the referrer though. This does the refresh to the malware site: