> what really puzzles me is the redirection. I'm thinking it has to do with the routes

There are many possibilities. I'd, personally, refrain from using the words "tampered" and "attacks" since they carry a moral implication.

It also seems it could be that a name based virtual host configuration changed mid session. I suppose this could be considered routing in a sense as well.

Again, the fact that it hasn't happened often and that your memory/knowledge of the exact transaction of packets is likely incomplete, makes all this just speculation.

My guess is it's probably just a glitch and nothing nefarious is going on. I wouldn't be too worried.

It's good you're keeping an eye on things though!