> They used an IP that was originally reserved for what reserved IP's are used for.

I'm eagerly awaiting your evidence for this statement, which to my knowledge is entirely incorrect.

So far's I know, existing uses of 1.1.1.1 have almost universally been illegitimate (e.g. captive portals, internal-ish services, …)