So it's not on the common host "null-route" lists hagezi/dns-blocklists or urlhaus.abuse.ch, which is where I would expect this to come from. I'm starting to wonder what's going on here...