> They only know the IP address of the remote server.

It's the internet. Everyone can scrape links and measure/correlate which assets were on them to correlate likely visited websites.

Especially if every web page these days is pretty unique in terms of what kind of assets (network streams) with what kind of byte size were loaded at which point in the document loading timeline.

Now include the TLS fingerprint of your web browser and well, privacy went to shit.

HTTP needs an upgrade with scattering and rerouting on the fly, otherwise these deanonymization techniques can never be fixed.

> HTTP needs an upgrade with scattering and rerouting on the fly, otherwise these deanonymization techniques can never be fixed.

Isn't that e.g. TOR's job? Doesn't belong in HTTP.

and the SNI, until ECH is widely adopted, SNI is leaked in plaintext when connecting to a server, it needs to because how will the server know which TLS cert to reply with?

And nobody would ever think of keeping a reverse DNS index.

With shared hosting, NAT, etc. there may be several sites sharing the same IP.

Doesn't amount to much if any one of those sites is on a watchlist.