My cgminer started falling back to a backup pool and no longer connecting to the Waffle EU server. I see in my firewall logs that it tries to connect to 206.223.224.225:3009. Is that address related to Wafflepool and how so? It shows on whois lookup as a residential cable in Montreal, Canada. If I restart the cgminer it connects to Waffle EU normally but the same thing happens after a while.
I saw this as well with the same IP. Myself and a couple other people are trying to track down the problem on #wafflepool
My theory is dns hijacking

I've set up some network capturing hardware to try and figure out what happens
Yeah my stratum url has changed to the same thing. When I google that IP address I get a result about potcoin on github, but I'm not using that.