Here's another example: Recently my wifi antenna broke on my phone, and
   I used cellular internet more frequently.
   I found that on my cellular internet, I was getting a fake
   [1]google.com page. Very similar to the real thing, subtly different.
   When I traveled near wifi, my wifi delivered a more accurate
   [2]google.com page.
   I could switch between network interfaces and see the difference.
   In this instance, one would assume the change is happening among the
   cellular networks.
   It could theoretically be possible to collect logs of a lot of these
   events, over time. I suspect many have already done this.
   It would also be possible to contact relevant network operators and
   work with them.
   It could also be possible to capture compromises and analyse them.
   I suspect many have already done that, too.
   Once you have a real compromise you can look at, you may have a tiny
   bit of information on where the issue stems from. Just a tiny bit.
   It may also be possible to communicate with the issue in some way. But
   it may be disinterested in revealing who or what it is, possibly
   depending on its trust for you.

References

   1. http://google.com/
   2. http://google.com/