This reminds me of Cloudflare taking over 1.1.1.1

This was a typical fake entry in captive portals, or a temporary gateway.

They described (cannot find the blog post right now) the various traffic they were getting, across many services (default ports)