SOCKS packets are quite easy to identify it seems.

AWS IP and Subnets are likely has been blocked in GFW.