The same is happening here in Australia talking to people.
So they're either reading signatures left on the packets by various VPN / proxy technologies (fragmentation and other obscure metrics), or they're blocking the IP ranges of major hosting providers, or both.