Maybe they were using 1.1.1.1 as a null route?