The attack and concealment work because the server not the client makes queries that encode the visitors IP and device type.