When I was on virgin, I noticed that ip addresses used by some TPB or similar websites weren't routed to the internet, which is obviously quite bad. I'm not sure if it's still what they do. Better ISPs only do DNS blocking though. Some don't block anything actually.

oof, this is serious, thanks for letting me know

They can block the IPs or watch for SNI requests.

It's far from as complex as the Great Firewall of China.

I don't think the main complaint about the Great Firewall of China is its complexity.

For now...

I donno about the UKs system but with South Korea they just check the host in the request header and block by that.

How can they do that, the HTTP headers are encrypted by TLS?

Until encrypted SNI/encrypted client hello is a thing, the hostname is still sent in the clear.

Also, it can still be DNS blocked - just because you use Cloudflare's DNS doesn't mean they can't rewrite the responses as they still transit unencrypted. You'd have to use DNS-over-HTTPS or DNS-over-TLS to work around that.

If it's TLS1.2, certificates containing CNs and/or SANs are sent in the clear too.

Luckily, ESNI is being supported by an increasing number of implementations.

I believe China's answer to ESNI is just to block all traffic that attempts to handshake with ESNI, so it still won't necessarily get you anywhere.

Once everything is using ESNI this isn't a problem anymore. It's the lack of implementation that is currently the problem.

Maybe it's actually SNI.

not op, no idea how they do it but they COULD look at the SNI in the client hello

In that case it's your ISP (Virgin Media). My niche ISP gives me unfiltered internet. Also, I run my own recursive resolver.

Try an SSL DOH resolver, which can't be subject to simple transparent intercepts (at least not without you knowing about it).