Currently, Airtel is blocking based on the Host header. If they can't see the Host header, they'd have to instead know TPB's origin IP, which they wouldn't.

1) SNI indicators on the HTTPS handshake deliver the hostname to the DPI processor, be it on the connection Consumer => CF or CF => TPB.

2) Most likely the provider has a trusted CA... and CF => TPB connection does not support pinning.

3) Provider redirects to interceptor, which serves a "blocked" notice page, with a trusted HTTPS cert.

Alternative to 2 & 3 in case provider doesn't want to risk his CA: simply drop the connection by injecting a FIN packet once TPB is seen in the SNI headers.