[bawolff]

Sometimes people use the phrase mitm loosely to mean sniffing SNI and then blocking the connection in some fashion.

[JorgeGT]

Apologies if the usage is incorrect. They appear to indeed sniff the SNI and then inject a one-line website with a self-signed certificate: https://pastebin.com/RHwPWBug

[bawolff]

Its still possible that instead they are just hijacking the ip space. You could probably distinguish by running traceroute. Or doing something like curl https://186.2.163.219 --header "host: sci-hub.se" -k (which should not send an SNI that can be sniffed but still send the corect host header inside the encrypted http stream so the connection would work minus a cert failure, but DPI by the isp wouldnt be able to detect. If that curl fails they are probably doing ip address hijacking. If domain-fronting request works then they are probably sniffing SNI)

[JorgeGT]

Good idea! I tried the domain-fronting curl request and it works, so they seem to be indeed sniffing the SNI...

[dwightgunning]

Thanks both for taking the time to acknowledge and explain the subtlety. Helps somebody like me who’s casually following along to better understand both scenarios.