I think it’s fingerprinting - if you look in the logs it gives you certainties of different devices that it thinks it might be