This reminds me of Cloudflare taking over 1.1.1.1
This was a typical fake entry in captive portals, or a temporary gateway.
They described (cannot find the blog post right now) the various traffic they were getting, across many services (default ports)