3 ms·

Good idea! I tried the domain-fronting curl request and it works, so they seem to be indeed sniffing the SNI...