They do. I used AWS and socks, and they always detected it after 2 days somehow.
Some Chinese Proxy community tend to use an method that mimick an packet that looked something else to trick the DPI(?)
I suspect AWS snitched.
SOCKS packets are quite easy to identify it seems. AWS IP and Subnets are likely has been blocked in GFW.