Even this isn't enough anymore. About one or two years ago I was fooling around with DNS queries out of boredom and I did a simple nslookup on a domain I knew w

Even this isn't enough anymore. About one or two years ago I was fooling around with DNS queries out of boredom and I did a simple nslookup on a domain I knew would be NX (it was a .ss address), lo and behold it returned an IP and the responding DNS server was not what I use, tried another domain I knew would be non-existent... Same IP, browsed to it and I got a Spectrum "search" (it literally showed results for related sites I had been browsing) page. The real problem with this is that I never use the ISP supplied DNS servers. I double checked everything to ensure something in the network chain didn't default to the ISP DNS, turned out either Spectrum was either hijacking every DNS query but passing valid replies or running DPI and hijacking certain queries. I reported all this to EFF but never heard back. I switched to DNSCrypt to mitigate.