content: Probably try to make a comprehensive updated list of the entry/exit IP addresses/ranges that the VPN providers use and just add them to the "great firewall." They could probably track payments to restricted services in some instances.