ISPs who routinely intercept all DNS traffic and rewrite some of the records.