Some Chinese Proxy community tend to use an method that mimick an packet that looked something else to trick the DPI(?) 

 I suspect AWS snitched. 

 SOCKS packets are quite easy to identify it seems.

AWS IP and Subnets are likely has been blocked in GFW.