Every website used to be like “www.example.com”. Now I rarely encounter this “www.”. Why did it even exist and where has it gone? I also used to run into websites with legitimate domains, but “ww1.” instead of “www.”, these were probably phishing sites, but how did this actually work on top of legitimate domains?


No, it was to distinguish your web server hostname from your other service host. For example, “www.google.com” is (possibly) a different A/AAAA record than “smtp.google.com” And google.com is the domain those hosts are in, for their forward lookup.
For record, in-addr.arpa. has all the IPv4 and ip6.arpa. has all the IPv6 reverse lookup records.
It is superfluous information as a browser address. For a browser address there is a default intention of accessing web pages.