This connection was secured using TLS/SSL for '30daysofbiking2018.worldbicyclerelief.org'
The HTTP request specified 'Host: 30daysofbiking2018.worldbicyclerelief.org.', which is (obviously) different.
Because this looks like a domain fronting attack, the connection has been terminated.