http://k3oxb4lrs7l3vt2lhy3w5ilrrqzeltdxjyne3t7sctmnyu3ypwpuszid.onion/sni-bug.html
Effectively the customer has gained free access to the entire web due to the SNI bug. SNI bug hosts are often SSL/TLS sites proxied by a CDN. If the ISP checks only the SNI, and does not check the SNI against the IP address of the server, you can use the related technique of "SNI spoofing."