Indeed. But still surprising that they still keep trying.
They do. I used AWS and socks, and they always detected it after 2 days somehow.
Some Chinese Proxy community tend to use an method that mimick an packet that looked something else to trick the DPI(?)
I suspect AWS snitched.