Bad writing and editing.
128.128.1.1 might be an IP Address for 1 piece of hardware that is configured as a server.
128.128.5.100 might be an IP address for 10 pieces of hardware all linked together, all operating as a single server.
The second one just has a much higher storage capacity, and depending on the type of hardware, would be faster.
Or serving up 10 separate domains on 10 separate OS's (no hacker gold mine in theory). But there is what you might call a hacker silver mine which is that poor administrators would likely create linkages from one server to another or to a set of front end servers through a back end server running a database (hence a gold mine).
I think your point is pretty valid no matter what the configuration especially considering the likelihood of cheapness and sloppy administration.
Many thanks...