[jfim]

I believe they use WebRTC for that, eg: https://browserleaks.com/webrtc

[Nerada]

Interestingly, RTCPeerConnection and RTCDataChannel come up as "True", but the IP address fields come up as "n/a".