That's called domain fronting. CDNs already switch between virtual hosts with headers on HTTP requests and HTTPS TLS SNI, so this even passively happen sometimes.
Now, HTTP headers and SNI are both unencrypted, so oppressive governments abuse these. Obvious fix is to make'em encrypted by enforcing HTTPS everywhere and upgrading SNI to ESNI with DoH-obtained per-server public keys.
Some of offensive side fixes to the defensive side fix are: blocking ESNI, blocking DoH, forcing use of MITM proxy, just blaming strawman terrorist groups for having to block affected IPs. etc.
Comments
That's called domain fronting. CDNs already switch between virtual hosts with headers on HTTP requests and HTTPS TLS SNI, so this even passively happen sometimes.
Now, HTTP headers and SNI are both unencrypted, so oppressive governments abuse these. Obvious fix is to make'em encrypted by enforcing HTTPS everywhere and upgrading SNI to ESNI with DoH-obtained per-server public keys.
Some of offensive side fixes to the defensive side fix are: blocking ESNI, blocking DoH, forcing use of MITM proxy, just blaming strawman terrorist groups for having to block affected IPs. etc.