Has example.com/test (et al) been hacked on http?

Has example.com been hacked on some http URLs? I get 404 for example.com URL of https /test but I receive some claimed 606 byte webp file if instead I use http /test which seems irregular to me. Similarly odd junk returned on http (not https) for /robots.txt and /favicon.ico ... I checked using google DNS 4.4.4.4 by Frontier Fios with iPad Air 2 on iOS 11.3 Safari and separately using vanila T-Mobile access (their DNS) on an iPhone iOS 11.3 Safari. Caveat Emptor: I've not direct linked to any of the oddly behaving URLs for reader's browsing safety, just in case. If this is normal, is there documentation somewhere spec'ing variant behavior of example.com URLs?