I caught Vodafone and Telekom in Germany injecting headers.
The former for shady cooperations and tracking, the latter for cache screwery. The latter did dns modification to turn nxdomain into a navigation help, a site that looks like google but everything is ads.
Vodafone CPE equipment saves all mac adresses ever present in the local network and unassociated wifi client macs in the air and sends them back as part of diagnostic data.
Edit:
They also DNS Censor popular warez sites and libgen
Vodafone CPE equipment saves all mac adresses ever present in the local network and unassociated wifi client macs in the air and sends them back as part of diagnostic data.
Edit: They also DNS Censor popular warez sites and libgen