There’s no way of knowing what happened there.
But back in the mid to late 2000’s we had a whole bunch of residential internet customers and every so often one would blow their traffic cap by a bunch and would ring up and say “Your billing system is wrong!”.
Then whoever could be bothered in the office would do some modest analysis on their netflow data and come up with something like "18% of your traffic this month was redtube.com, 33% was pornhub.com and 9% was xhamster.com.
We never knew if whoever was on the phone was the raging porn addict or it was one of their associates. Either way they would say “Oh well, I guess we will never know then. Thanks for your help. Bye.”. Followed by them quietly paying the bill.
Current ISPs have to by law. Just incase you go on howtobeaterrorist.com and need to be stopped. It’s not overstepping at all. Definitely not.
Yep, any time you have a traffic cap or bill for traffic you’ve got to have data to back up what you are billing for.
More recently CDN’s ( and widespread SSL adoption ) have made it a whole lot less obvious what sites the user is going to. I suspect that nice clearcut list of porn sites from 2007 would just look like some cloudflare, akamai and google these days.
