Strangely, I get a Russian IP address for an answer when I query 1.1.1.1 for archive.is:
┌─(~/Projects/malware/triangulation)(ruby-2.5.0)────────────────────────────────────────────────────────────────────(c@c:s001)─┐
└─(12:32:59)──> nslookup archive.is 1.1.1.1 ──(Wed,Aug02)─┘
Server: 1.1.1.1
Address: 1.1.1.1#53
Non-authoritative answer:
Name: archive.is
Address: 89.253.237.217
┌─(~/Projects/malware/triangulation)(ruby-2.5.0)────────────────────────────────────────────────────────────────────(c@c:s001)─┐
└─(12:38:12)──> nslookup archive.is 1.0.0.1 ──(Wed,Aug02)─┘
Server: 1.0.0.1
Address: 1.0.0.1#53
Non-authoritative answer:
Name: archive.is
Address: 89.253.237.217
┌─(~/Projects/malware/triangulation)(ruby-2.5.0)────────────────────────────────────────────────────────────────────(c@c:s001)─┐
└─(12:38:14)──> whois 89.253.237.217 ──(Wed,Aug02)─┘
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object
refer: whois.ripe.net
inetnum: 89.0.0.0 - 89.255.255.255
organisation: RIPE NCC
status: ALLOCATED
whois: whois.ripe.net
changed: 2005-06
source: IANA
# whois.ripe.net
inetnum: 89.253.232.0 - 89.253.239.255
org: ORG-RL31-RIPE
netname: RU-RUSONYX-NET6
descr: Network for Rusonyx infrastructure
country: RU
mnt-lower: MNT-RUSONYX
mnt-routes: MNT-RUSONYX
admin-c: VZ1716-RIPE
admin-c: VZ1717-RIPE
tech-c: VZ1716-RIPE
status: ASSIGNED PA
mnt-by: MNT-RUSONYX
created: 2018-10-10T09:53:33Z
last-modified: 2018-10-16T12:37:40Z
source: RIPE # Filtered
organisation: ORG-RL31-RIPE
org-name: Rusonyx, Ltd.
country: RU
org-type: LIR
address: 5th st. Yamskogo Polya, 9, office 19
address: 125040
address: Moscow
address: RUSSIAN FEDERATION
phone: +74951370701
fax-no: +74951370701
mnt-ref: RIPE-NCC-HM-MNT
mnt-ref: MNT-RUSONYX
mnt-by: RIPE-NCC-HM-MNT
mnt-by: MNT-RUSONYX
abuse-c: AD11015-RIPE
created: 2006-08-18T09:59:51Z
last-modified: 2022-10-06T11:18:08Z
source: RIPE # Filtered
person: Viktor Zverkov
address: P.O. Box 19
address: 127137, Moscow, Russia
address: Rusonyx ltd.
phone: +7 495 5089959
nic-hdl: VZ1716-RIPE
mnt-by: MNT-RUSONYX
created: 2017-09-20T11:29:16Z
last-modified: 2022-07-05T14:00:10Z
source: RIPE
person: Viktor Zaytsev
address: P.O. Box 19 , Russia
address: 127137, Moscow
address: Rusonyx ltd.
phone: +7 495 5089959
nic-hdl: VZ1717-RIPE
mnt-by: MNT-RUSONYX
mnt-by: AM65535-MNT
created: 2017-09-20T11:54:54Z
last-modified: 2018-08-02T17:21:31Z
source: RIPE
% Information related to '89.253.232.0/21AS41535'
route: 89.253.232.0/21
descr: RUSONYX-RU
origin: AS41535
mnt-by: MNT-RUSONYX
created: 2017-11-24T09:34:37Z
last-modified: 2017-11-24T09:34:37Z
source: RIPE
% This query was served by the RIPE Database Query Service version 1.107 (DEXTER)
Not sure why this would be happening (looks like at least one other person in the thread is seeing same result).