Hi folks. I'm Mark Turner, the blogger who discovered this situation.
Thanks to the help of a few folks who commented on my blog, I was able to learn that the 28.x.x.x IP was assigned to my phone's interface. Thus it appears Sprint has "borrowed" addresses from the DoD. Because SIP packets contain the source IP (unlike the other traffic from my phone) the internal IP was leaking through Sprint's NATting, causing my confusion. It's all harmless, though a good argument for moving to IPv6!
Mindcrime's correct. It's my blog: I write for me and nobody else. If you liked something, great. If not, there's plenty of other links here on HN. Knock yourself out.
In this case, I added those comments to my post so that a non-technical audience would better understand the mindset. Believe it or not, not everyone thinks the way we geeks do. :)
Thanks to the help of a few folks who commented on my blog, I was able to learn that the 28.x.x.x IP was assigned to my phone's interface. Thus it appears Sprint has "borrowed" addresses from the DoD. Because SIP packets contain the source IP (unlike the other traffic from my phone) the internal IP was leaking through Sprint's NATting, causing my confusion. It's all harmless, though a good argument for moving to IPv6!