Loading story…
The Federal Bureau of Investigation has issued a subpoena to domain registrar Tucows, demanding detailed subscriber information to identify the individual or group behind Archive.today (also known as Archive.is and Archive.ph), a website that archives web pages and is frequently used to bypass paywalls. The subpoena, dated October 30, was made public when Archive.today’s official X (formerly Twitter) account posted a copy of the document, despite instructions for secrecy. The FBI is seeking names, addresses, billing information, phone records, payment details, internet session logs, and any associated cloud computing services related to the site’s ownership, as part of a federal criminal investigation, though no specific crime was cited in the order.
Tucows, headquartered in Toronto and incorporated in Pennsylvania, confirmed its policy of complying with valid legal requests but declined to comment on ongoing investigations. The subpoena warns that failure to comply could result in contempt of court. The investigation has drawn attention due to the mysterious nature of Archive.today’s ownership, with speculation about the operator’s identity and possible ties to Europe or Russia. The case highlights ongoing tensions between law enforcement efforts and privacy advocates, as well as the challenges of unmasking operators of controversial online services.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The FBI sent a subpoena to domain registrar Namecheap seeking records that could identify the person or entity behind the Archive.today/Archive.is/Archive.ph network. The legal demand marked a formal law enforcement effort to unmask the operator of the archiving site.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **FBI**, working with European and other international law enforcement partners, seized and dismantled the **LeakBase** cybercriminal forum and marketplace in a coordinated action dubbed **“Operation Leak.”** LeakBase, active since 2021 and run as a subscription-based service, was used to buy, sell, and share stolen databases and sensitive data including **compromised credentials**, **PII**, payment data, and other access-enabling information; authorities warned that the forum facilitated activity that could enable access to U.S.-based networks, including potentially **critical infrastructure**. Authorities redirected LeakBase domains (including `leakbase[.]ws` and `leakbase[.]la`) to an FBI seizure banner and moved DNS to bureau-controlled infrastructure (e.g., `ns1.fbi.seized.gov`, `ns2.fbi.seized.gov`). The takedown was executed under U.S. and German court orders, and officials stated they secured and preserved the forum’s content for evidentiary purposes, including user accounts, posts, private messages, and **IP logs**. The operation reportedly included **100 law enforcement actions** against **45 targets** across more than a dozen countries, disruption of hosting infrastructure spanning locations such as the Netherlands and Malaysia, and outcomes including **13 arrests**, **32 searches**, and interviews with **33 suspects**; the investigation was led by the FBI’s Salt Lake City field office, and the FBI solicited tips via `FBI-SU-Leakbase@fbi.gov`.
Jun 29, 2026
Wikipedia’s English-language community moved to **deprecate and spam-blacklist Archive.today** (including related domains such as *archive.is* and *archive.ph*) and begin removing its links across the encyclopedia after allegations that the service **“hijacks users’ computers”** to participate in a **distributed denial-of-service (DDoS)** attack. Editors cited reports that visitors to Archive.today’s CAPTCHA page unknowingly executed JavaScript that generated requests to blogger **Jani Patokallio’s** Gyrovague site, allegedly to drive up hosting costs and force attention; Wikipedia discussions referenced this behavior as incompatible with external-linking policies and initiated steps to block new links and remove existing ones. During the deprecation discussion, editors also raised integrity concerns, citing evidence that Archive.today **altered archived snapshots**—including inserting references to the targeted blogger—undermining the service’s reliability as a citation source. The decision affects a large footprint on Wikipedia (reported as **~695,000 links** across roughly **~400,000 pages**), with editors noting that many uses can be replaced by other archives; Ars Technica also reported that Archive.today is subject to an investigation in which the **FBI is attempting to identify the site’s founder/operator**, whose identity has been described as opaque.
Jun 29, 2026
US law enforcement seized the **RAMP (Russian Anonymous Marketplace)** cybercrime forum’s infrastructure, taking over both its Tor and clearnet presence and replacing them with a “This Site Has Been Seized” banner attributed to the **FBI**, coordinated with the **US Attorney’s Office for the Southern District of Florida** and the DOJ’s **Computer Crime and Intellectual Property Section (CCIPS)**. RAMP was a key marketplace for **ransomware-as-a-service (RaaS)** promotion and related criminal services, including activity by extortionists and **initial access brokers**; the seizure banner also taunted operators with the forum’s slogan, “**THE ONLY PLACE RANSOMWARE ALLOWED!**,” alongside an image of *Masha* from the Russian children’s cartoon. While authorities had not publicly detailed the operation at the time of reporting, technical indicators supported the takeover, including DNS changes consistent with prior FBI seizures (e.g., nameservers set to `ns1.fbi.seized.gov` / `ns2.fbi.seized.gov`). Reporting also cited an alleged operator (“**Stallman**”) acknowledging law enforcement control, and noted the seizure could expose forum user data (e.g., email addresses, IP addresses, and private messages), increasing identification and arrest risk for actors with poor OPSEC. Background context indicates RAMP emerged after other Russian-language forums restricted ransomware promotion under increased law-enforcement pressure.
Jun 29, 2026