We use the example.com often for domain name reference. I wonder if any IP address used as an example IP address to mention in references like tutorial or notes?. I knew the loop back interface 127.0.0.1 can be used but it has been known for local system always.
Can example.com IP Address used for this purpose legally?
I'd use one of the private ranges, e.g. 192.168.1.1. I wouldn't use anyone's public IP space.
I use 1.2.3.4 most often, it seems like made up IP.
When you are in local network, local network IP addresses can be confusing. So I think something suspicious looking would be good practice.
Can example.com IP Address used for this purpose legally?
Any IP address can be used as an example legally - there's no law that would prevent you from doing that. Using one of the private ranges or an invalid one (making any of the four numbers greater than 255) will prevent anyone accidentally flooding someone's IP with an infinite loop or something based off your examples.
How about looking up to which address resolves the example.com domain?
The blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3) are provided for use in documentation.
From rfc5737
This would have similar use to the phone numbers in movies starting with 555-...
IP 1.2.3.4 appears to be too synthetic. Maybe you can use www.icann.org ( 192.0.32.7 ), or tempuri.org ( 207.46.197.32 ).
If you are just using it for an example in documentation, pick an IP address that isn't technically valid (like 192.168.0.256). It still conveys the point, but you don't have to worry about it being in use.
There is no law against abusing someone elses domain or IP address in examples, but it is a very bad idea.
For example will the IP address 1.2.3.4 be in use soon, as IPv4 addresses are running out quite quickly. There are already some concerns about this and that address.
RFC5737 is about IPv4 addresses used for examples, which are any address in networks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2) and 203.0.113.0/24 (TEST-NET-3), like 192.0.2.10, 198.51.100.3 or 203.0.113.254. These should not exist on Internet.
RFC3849 is about IPv6 addresses used for examples, which are any address in 2001:db8::/32. These should not exist on Internet.
RFC2606 is about reserved TLD:s for different use. Those are ".test", ".example", ".invalid" and "localhost". Any domain under those can be used, like "a-host.example"
"test" is used for testing, "example" for documentation, "invalid" in configuration files that needs to be tweeked and "localhost" for 127/8 (mostly 127.0.0.1). There are also three reserved second level domains to be used for example domains (example.com, example.net and example.org).
RFC1981 is about the private network addresses 10/8, 172.16/12 and 192.168/16. Those are private and should not exist on Internet, so they might be used for example networks.
RFC3330 should be of interest as an overview of all special IPv4 networks.
Use http://www.rfc-editor.org/ for reading those RFC:s