You might want to update this solution with the fact that TLS one.three encrypts the SNI extension, and the most important CDN is performing just that: web site.cloudflare.com/encrypted-sni Naturally a packet sniffer could just do a reverse-dns lookup for the IP addresses you're connecting to.This may change in future with encrypted SNI and DNS but