I found that on my cellular internet, I was getting a fake google.com page. Very similar to the real thing, subtly different.

When I traveled near wifi, my wifi delivered a more accurate google.com page.

I could switch between network interfaces and see the difference.

In this instance, one would assume the change is happening among the cellular networks.

It could theoretically be possible to collect logs of a lot of these events, over time. I suspect many have already done this.

It would also be possible to contact relevant network operators and work with them.

It could also be possible to capture compromises and analyse them.

I suspect many have already done that, too.

Once you have a real compromise you can look at, you may have a tiny bit of information on where the issue stems from. Just a tiny bit.

It may also be possible to communicate with the issue in some way. But it may be disinterested in revealing who or what it is, possibly depending on its trust for you.