Three Mobile do this also. I run my own nameservers instead of using theirs, so it doesn't affect me any more.
Three use 'Barefruit' as the company to provide this 'service' - NX is remapped to 18.104.22.168
It's still evil though, and assumes internet == web and can break all sorts of other things.
Whilst they appear to firewall everything apart from TCP port 80, there are still issues that I would be interested to get clarified legally.
Firstly, I am NOT saying that Barefruit, Three, Talk-talk, or any of the others are doing any of the following. In fact it would be commercial suicide if they did, and for little or no gain. So I'm not implying any bad faith here on any of the actors.
However, a *major* mistake of theirs in my opinion is they remap *all* NXDomain results, even if the domain portion is valid, so, for instance, if a three customer goes to http://forum.theregister.co.uk/ (note the missing 's') they will be sent to this third-party site, DOMAIN COOKIES INCLUDED.
A hackers dream to steal login credentials.......