My thoughts exactly - in which case archive.is might have the IP address(es) of the perpetrators in their logs. Worth checking out.