Examples?

Deutsche Telekom (largest ISP in Germany) did this, not sure if they still do or were ordered to stop by court yet

There were certainly a number of ISPs in the UK that tested ways to inject ads in content in the 2000s, there was quite a hoo-hah about it in some forums. This was usually by modifying HTML content in transit via transparent proxies though, not DNS poisoning. This is one of the reasons that HTTPS-everywhere is a good idea even if you aren't concerned about snooping in general.

An example I remember is when Virgin Media replaced any DNS queries returning NXDOMAIN with their own "search page" plastered with ads.

https://shkspr.mobi/blog/2021/03/advanced-network-error-sear...

Ah, yes, I forgot the NXDOMAIN hijacking.

Verisign tried this trick too.

https://dn.org/the-sitefinder-debacle-that-shook-the-interne...

AT&T still does this, if you're using their (intentionally terrible) standard gateway device the default DNS will return a "search page" instead of NXDOMAIN which predictably has all sorts of negative impacts on non-browser devices but the wastes of oxygen responsible for this don't care as long as they see that delicious ad revenue.

AT&T definitely used to do this ~14 years ago.

Some mobile phone network carriers would inject certain PII (such as your mobile number) into HTTP request headers sent to ad networks. I'm sure they still do it, but by requiring the site to have some extra request to be made instea.

Some carriers also passed info in these headers to be used to make billing calls to the Telco, such as subscribing to premium services with minimal (if any) consent from the user.

I got stung by this years ago. An ad for mobile ringtones showed up on some news site I visited on my phone, I scrolled past without clicking. Next minute I get a text telling me I've subscribed signed up to a (iirc) $25/month ringtone plan and that it'd show up on my phone bill. It took an hour on the phone to my carrier to block the charges and get a refund. The ringtone company kept messaging me for a year that I needed to contact them and "fix" the issue.

Insanity that people used to pay more for goofy little midi files than they do now for Netflix.

I dunno what was in a ringtone subscription. I used to work at a ringtone company, and it was $1-$3 per ringtone ($1 for monophonic, $2 for polyphonic and $3 for wav/mp3/whatever; which yeah, is more than a high quality download from iTunes... But $25/month is a ton of money.

Even with free ringtones, I'd send myself about three if I got a new phone. These days, I just keep a copy of the Nokia dubstep ringtone on hand in case I turn the ringer on, but it doesn't happen.

As someone who was sometimes using http as a back end transport for "edi" data (hey at the time it was usually ftp in that industry so no worse, but at least http got around nat problems than even pasv didn't), one time in the mid 00's I was in a coffee shop and just speechless flabbergasted outraged to discover the contents of a random web page I happened to know the contents of get some extra html and js injected into it from the isp (the isp not the coffee shop).

"WHO THE F gave them the right to modify the data in my tcp session!!!!".

Spying on it I assumed but modifying one byte of it? A naively written edi that did not expect that would be completely destroyed.

Probably shouldn't have been so stupid for 15 years already by that point. There is no such thing as the right, there is only the ability.

If someone has the ability to do something, they will. Reputation, right & wrong, none of that actually exists or matters.

That's one of the reasons we now have HTTPS in most places.

It's another thing to point out when someone (who used to include myself) says "but this site doesn't have anything sensitive".

Time Warner Cable used to do it. I haven't checked since they became Spectrum.

Comcast and/or verizon did it in the 2010s, there was literally an opt-out in the account dashboard.

It's sort of an absurd question, the prevalence of such things by ISPs was the literal impetus for DoH and DoT.

Last I checked Verizon FIOS still has the opt-out. You have to go into your account preferences and manually disable it because spying is on by default.

This is a good reminder to login and take a look, I wouldn't put it past them to change the setting name and reset the default.

You should be NATing outbound 53 to a local resolver that upstreams to DoH/DoT. Relying on such an opt-out is rather optimistic.

I don't use their resolver at all. Their opt-out was more of an all-encompassing "let us take whatever data we can manage to get" than DNS specifically.

Yep, I've been in Verizon online account purgatory for awhile now. They merged my mom's with mine and nothing works to reset or restore online account access for even bill pay. I have to push their payment out via billpay. I really need to move that phone number over to voip, I kept the classic POTS line as a type 1 diabetic I like that it stayed on during both NYC blackouts in 2003 and 2012. But now I'm in a fiber only building and that redundancy is mostly moot.

Thank you for this. Just opted out. They certainly made that page as hard as possible to find. Figuring out how to change my routers DNS server was also made needlessly complex.

IIRC, early into ATT’s US fiber / gigabit rollout, they wanted an additional $40 / month to forgo collecting and selling your browsing history (DNS queries).

RCN definitely was doing it for a while, so was Comcast. I learned quickly to override this garbage

AT&T has been well-known to do this, since they are violently opposed to net neutrality and they want to force you to only use their approved paid partners for everything. They do this on all their internet services.

Netflix has always listed AT&T as their number one worst offender when it comes to net neutrality.

So, I always run VPNs that I can trust.

I hijack DNS in my LAN and block popular DoH servers so they would have to fall back to my DNS. It is a good way to block ads for smart TVs and services that try to use DoH to bypass DNS level ad-blocking.

Do you use a dynamic list of IP addresses to block ?

Cool story