SNI (Server Name Indication)
A plaintext field in the TLS handshake that tells the server which site you want, used by censors to filter traffic.
SNI (RFC 6066) is a TLS extension that lets one server host many HTTPS sites. The client puts the target hostname in the ClientHello so the server knows which certificate to present. The field is sent in plaintext because the encryption keys haven't been negotiated yet — the server needs to know which cert to use before it can encrypt. This creates a small but critical leak: anyone on the path between you and the server can see which domain you're connecting to, even if every byte after the handshake is encrypted.
The GFW uses SNI as a primary filter. When you connect to a server, the GFW parses the ClientHello, reads the SNI, and checks the domain against a blocklist. If the domain is blocked (a specific VPN provider, a specific news site), the GFW resets the connection. This is why some sites are reachable by IP but not by hostname, and why connecting to a blocked SNI from a censored network always fails regardless of port or protocol.
Long-term fix: ECH — once the SNI is encrypted, the GFW's filter has nothing to read. Short-term workarounds: domain fronting (put a non-blocked SNI in the outer ClientHello and the real one in the HTTP Host header — Cloudflare deprecated this in 2022), using a CDN that allows arbitrary Host headers, or tunneling through a proxy that wraps everything in TLS to a non-blocked domain. IPCombo can't bypass SNI filtering, but it can show whether your SNI is reaching the target or being reset by an intermediary.