I'd be surprised if it was the only thing they used, to be fair. But there is fairly obviously some IP-specificity going on.

So you need to control your IP address but your example shows it doesn't matter?