Images loading fine on day 1, broken on day 2 Strange problem.  

Images on my production site are 100% working at one point (right after getting a refresh from staging), and within a day or two, some images on some pages become broken links.  

(Production is updated from staging through mysql database dump/restore).

As I continue to watch this over the course of subsequent days, more pages in production experience this symptom, but the images are always there in staging - never broken.

Here's some data...
When viewing the content of a page in the staging environment, an inserted image looks like this (Admin UI - view Source).

...installed one of the Outlook toolbars.&lt;/p&gt;&lt;p&gt;
[[{\"type\":\"media\",\"view_mode\":\"media_large\",\"fid\":\"123\",\"attributes\":
{\"alt\":\"\",\"class\":\"media-image image-style-large image-style-large image-style-large\",
\"height\":\"298\",\"typeof\":\"foaf:Image\",\"width\":\"264\"}}]]
&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Who can ...


When the Staging content is pushed to Production, viewing the same page in the Admin UI on the production server, the content starts out exactly the same and the image renders fine.

Within a day or two, the Production page changes (presumably by something Drupal Cron is doing) to something like this:

...installed one of the Outlook toolbars.&lt;/p&gt;&lt;p&gt;
&lt;img alt=\"\" class=\"media-image image-style-large image-style-large image-style-large image-style-large\"
height=\"298\" width=\"264\" typeof=\"foaf:Image\"
src=\"http://default/sites/default/files/styles/large/public/Send%20Securely%20and%20account%20selection.png\" /&gt;
&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Who can ...


The "img src" version that creeps in is a bad URL - 

http://default/sites/default/....


I've grep'ed my daily mysqldumps for this bad URL string, and each day there are a different number that creep in.

    for file in /data/mysqldumps/*sql
    do
      echo -n $file
      echo -n ": "
      grep -o "http://default" $file | wc -l
    done

/data/mysqldumps/20121205-160101.sql: 0 (Zero occurrences on Dec 5 because I pushed
                                         on that date, &amp; all images were known good)
/data/mysqldumps/20121206-160101.sql: 106
/data/mysqldumps/20121207-160102.sql: 130
/data/mysqldumps/20121208-000101.sql: 138
/data/mysqldumps/20121209-000101.sql: 157
/data/mysqldumps/20121210-000101.sql: 158


No local Admin changes have occurred on production, and nothing but cron is running there.

What can be causing this? It's only happening in production (which is totally awesome).

Any suggestions on troubleshooting?

Thanks,
Mark
There is a related issue for this here. http://drupal.org/node/1352182. 

What's happening is that drupal is storing the URL that is created when the page is first viewed after the cache is cleared. Normally that would be your site url, but sometimes it's not. 

In the issue linked you see that some people fixed this using the Pathologic module.