They do. I used AWS and socks, and they always detected it after 2 days somehow.
Some Chinese Proxy community tend to use an method that mimick an packet that looked something else to trick the DPI(?)
Please Login to reply.
I suspect AWS snitched.
SOCKS packets are quite easy to identify it seems.
AWS IP and Subnets are likely has been blocked in GFW.