I suspect AWS snitched.
SOCKS packets are quite easy to identify it seems. AWS IP and Subnets are likely has been blocked in GFW.