I’m a network engineer and I’m not entirely sure what’s going on. The ip addresses would be visible at some point or it wouldn’t work. I assume they’ve done the simple thing and ran a packet capture but a good chance it’s running through VPN so who knows