Yes, but this is probably served by the ISP's servers, into which traffic was redirected by the ISP's dishonest DNS. This is much easier to implement than full

Yes, but this is probably served by the ISP's servers, into which traffic was redirected by the ISP's dishonest DNS. This is much easier to implement than fully intercepting every HTTP connection, and this is what most ISPs go with.