They can intercept DNS, they can snoop on cert names, they can monitor any unencrypted traffic (you'd be surprised how much there is even when you think you're hitting every site with HTTPS..)