This is something that is probably effecting maritime satellite stations:http://www.wired.com/2015/09/turla-russian-espionage-gang-hijacks-satellite-connections-to-steal-data/
Legitimate satellite station IP addresses are being hijacked to hide malware command and control servers…