They have built a dictionary mapping the hostnames your phone talks to when certain apps are used (i.e. uber app talks to xxxx.uber.com). Altho there are milli

They have built a dictionary mapping the hostnames your phone talks to when certain apps are used (i.e. uber app talks to xxxx.uber.com). Altho there are millions of apps, they only need to have this dictionary for the "top" apps used by most people. Note they're not using DNS records, but rather the SNI portion of the HTTPS requests made by the phone.