They appear to do deep packet inspection looking at the SNI and insert an invalid certificate from Allot, redirecting the connection to a very short "Vodafone can't show you this" website: https://pastebin.com/RHwPWBug
It appears to work with ESNI activated in Firefox. Interesting to see these techniques in use...