I no longer have an ISP that injects ads into HTTP-only pages, but I did have one once. MITM is quite possible.