One of our readers has come across traffic leaving the network with a destination of CN and a destination port of tcp 8520.  

If you are seeing the same I'd like to know, even better if you have a capture of the traffic including the payload that would be great. 

Cheers

Mark H