FBI Issues Subpoena to Unmask Anonymous Owner of Archive.ph in Criminal Probe

FBI Wants to Know Who Runs Archive.ph

The FBI has issued a federal subpoena to domain registrar Tucows, demanding extensive billing and session records to unmask the anonymous operator of Archive.ph (Archive.is and Archive.today). The site, known for bypassing paywalls, is now the subject of an undisclosed criminal investigation.

The Federal Bureau of Investigation (FBI) has launched a probe to find the person or group behind the widely used archiving website Archive.today, and its alternate domains like Archive.is and Archive.ph.

Operating since 2012, the site creates snapshots of web pages, a feature generally used to bypass news paywalls or save content like government documents. While similar to the Internet Archive’s Wayback Machine, Archive.today‘s owner remains a mystery; meanwhile, the original domain links to Denis Petrov in Prague, Czech Republic, widely believed to be a fake name.

The creator is thought to be a single person, possibly Russian, with ties to Europe (suggested by language clues and donation requests in euros). Even today, very little is known about the people who run the site, which has saved hundreds of millions of web pages over the years.

FBI Issues Subpoena to Unmask Anonymous Owner of Archive.ph in Criminal Probe
The home page of Archive.ph (Screenshot: Hackread.com)

Federal Subpoena Details

The investigation came to light when the official Archive.today‘s X (formerly Twitter) account posted a copy of an FBI subpoena, dated October 30th. For your information, a subpoena is a legal order that forces someone to hand over documents or information.

This subpoena, first reported by the German news site Heise Online and then detailed by 404 Media, was sent to the Canadian domain registration company, Tucows, demanding extensive information about the site’s owner.

The subpoena is, reportedly, seeking the “customer or subscriber name, address of service, and billing address,” along with detailed records of the owner’s phone calls, payment information, internet session logs, and even any associated cloud computing services.

The document states that all this information is needed for a “federal criminal investigation being conducted by the FBI.” Interestingly, the document does not name any crime. The order specifically requested that Tucows keep the investigation secret, but the document was quickly posted online by Archive.today.

“You are requested not to disclose the existence of this subpoena indefinitely, as any such disclosure could interfere with an ongoing investigation and enforcement of the law,” the order stated.

It is worth noting that this action follows a similar crackdown in the publishing industry. Earlier this year, in July, the News/Media Alliance successfully got another paywall-skirting site, 12ft.io, taken down, claiming it offered “illegal circumvention technology” to access copyrighted content without paying.

Tucows has confirmed that they comply with valid legal processes like this subpoena, giving the FBI a deadline of November 29th to furnish the records. This development has made the question of who is truly behind Archive.today a highly debated topic online today.

Hackread.com has reached out to the Archive.ph team for comment.

Deeba is a veteran cybersecurity reporter at Hackread.com with over a decade of experience covering cybercrime, vulnerabilities, and security events. Her expertise and in-depth analysis make her a key contributor to the platform’s trusted coverage.
Total
0
Shares
Leave a Reply

Your email address will not be published. Required fields are marked *

Related Posts
Critical Monsta FTP Flaw Left 5,000+ Web Servers Open to Full Server Takeover

Monsta FTP Vulnerability Exposed Thousands of Servers to Full Takeover

Monsta FTP users must update now! A critical pre-authentication flaw (CVE-2025-34299) allows hackers to fully take over web servers. Patch to version 2.11.3 immediately.

A web-based file management application, Monsta FTP, was recently found to have a serious security problem that could allow hackers to completely take over a web server.

Cybersecurity firm watchTowr discovered and reported this issue in a technical blog post, shared with Hackread.com. For your information, Monsta FTP is a handy tool that lets users move and manage website files, performing uploading, downloading, and modifying directly through a web browser. This makes it a popular choice among users, from major financial institutions to individual website owners, as an alternative to installing separate computer software.

How did it all start?

The research that led to this discovery began when watchTowr was investigating older, known vulnerabilities in Monsta FTP, specifically looking at versions like 2.10.4. The team suspected that flaws reported in an even older version (2.10.3), which included Server-Side Request Forgery (SSRF) and arbitrary file upload issues (CVE-2022-31827, CVE-2022-27469, and CVE-2022-27468), might still exist.

Further probing revealed that the older versions shared the same lack of protection. This led the team to investigate the current version, where they ultimately found the new, major security gap.

Critical Flaw: Unauthenticated Access

The problem, now officially tracked as CVE-2025-34299, was a serious pre-authentication flaw. This means that attackers could use it before they even had to log in, without needing a username or password, leading to Remote Code Execution (RCE).

RCE is the worst kind of vulnerability because it allows a remote hacker to run their own code on the target server. In this case, CVE-2025-34299 allowed the hacker to trick the Monsta FTP system into downloading a file they controlled (which held the malicious code) and saving it anywhere they wanted on the victim’s server.

In its report, WatchTowr confirmed this method worked, noting, “It connected, pulled our payload, and wrote it to the specified path.” This ability to drop a malicious file, sometimes called a ‘web shell,’ means the attacker could grab full control of the entire server or hosting environment. According to their analysis, a minimum of 5,000 Monsta FTP instances were available on the internet, which means a large number of web servers were at risk.

The Fix

WatchTowr alerted the Monsta FTP development team about this critical security flaw on August 13, 2025. Developers quickly responded, and a patched version, Monsta FTP 2.11.3, was released on August 26, 2025. If you or your organisation uses Monsta FTP, you must update to version 2.11.3 or later immediately to keep your web server safe.

Deeba is a veteran cybersecurity reporter at Hackread.com with over a decade of experience covering cybercrime, vulnerabilities, and security events. Her expertise and in-depth analysis make her a key contributor to the platform’s trusted coverage.
Total
0
Shares
Leave a Reply

Your email address will not be published. Required fields are marked *