Who and where? How even, with the lack of http sites?

This German webhost does not include SSL in it's bare bones package without surcharge. Thus my kita had no SSL certificate, and thus I could detect my ISP or some hacked router injecting ads (Berlin) when I used that site.

There are plenty of local http sites due to German's (reasonable) distrust of US companies and a propensity to roll their own

https://m.all-inkl.com/webhosting/privat/#&ui-state=dialog

> thus I could detect my ISP or some hacked router injecting ads

The later sounds far more plausible than an ISP trying to get sued to the ground.