if their IP is picked up by RPC providers like Infura when they connect to Metamask or if they move it to other known addresses
lol if the state is against us and someone uses Metamask and Infura, they‘re ngmi