I think it’s SNI filtering, because I know that SNI spoofing works for Russia.
No. Any SNI is ‘allowed’ and posing as a whitelisted SNI doesn’t fix anything, that’s from a hands-on experience that I monitored via Wireshark. What makes the big difference - are the whitelisted IPs. If you connect to ya.ru, then it’s super fast, nothing gets blocked, if you pose as ya.ru for a connection for a not-throttled IP, then the SNI connection comes through, but exactly when real traffic starts to get transmitted, it gets blocked. That’s why spoofing the SNI does not fix ‘WebTunnels’ there. The domain fronting helps on a connection where there isn’t a similar whitelist-model.