How do web use loggers work?
If you use Google to look at a cached page that has images, the page fetches the images from the original site unless you use the proper voodoo [1] to tell Google not to fetch the images at all. So if they had the site flagged, they probably noticed your friend’s image URLs being fetched directly, while yours were being done indirectly (you’re sending a connect request to the proxy, and from there, you’re fetching the web page). Their traffic inspector may not be looking at the content of all packets, just the initial URL being fetched. [1] If you copy the URL of the cached Google page from the search and paste it into a new window, and append “&strip=1” (no quotes) to it, Google gives you the cached page without images.