Comment by gruez

probably dns/sni logs? with most sites using https that's all they're really going to get.