localhosts: check

i suspect it's the free WiFis that require you to comply with their terms and conditions. They probably catch the traffic and inject text ads into the HTML, which arguably is quite clever and malicious.

i'll get more data to confirm this