This is actually the reason that 1.1.1.1 gets so much traffic. People just assume it's not in use and can be abused a bit. Once it's available on the internet then all that excess traffic that was going nowhere gets transferred there.

Still, it looks more like malice since there are other addresses besides 1.1.1.1 that are also blocked.