[multjoy]

They didn’t. They went to ngrok and asked for all the data at the point of signup. They then looked to find the any of that data at the second site. In this case they had two identical data points - the GDID and the IP address.

[jimaway123]

What do you mean? The FBI could know that this VPN ip visited ngrok and then the retailer website, but how would it know that that ip was associated with the specific GDID unless microsoft was tracking (timestamp,website,gdid) tuples?

[codedokode]

Probably Windows constantly pings the MS server and they record those tuples.