I liked 1.2.3.4 because 
```
inetnum:        1.2.3.0 - 1.2.3.255
...
remarks:        ++++++++++++++++++
remarks:        + Address blocks listed with this contact
remarks:        + are withheld from general use and are
remarks:        + only routed briefly for passive testing.
remarks:        +
remarks:        + If you are receiving unwanted traffic
remarks:        + it is almost certainly spoofed source
remarks:        + or hijacked address usage.
remarks:        +
remarks:        + http://en.wikipedia.org/wiki/IP_address_spoofing
remarks:        + http://en.wikipedia.org/wiki/Regional_internet_registry
remarks:        +
remarks:        ++++++++++++++++++
```

so it is exactly what we would use them for -- for passive testing... on a quick look haven't found any other formal doc (eg RFC).  but in general I do not mind any of those to be used -- you decide as the initiator @grooverdan