Payload size would be very helpful, but they don't need that to shortlist candidates. Correlating the timestamps of when the comment appeared on HN and when the

Payload size would be very helpful, but they don't need that to shortlist candidates. Correlating the timestamps of when the comment appeared on HN and when the domain name was accessed from an internal IP may be enough, subject to luck. Considering that Google is already tracking (crawling) the entire web for its core business, adding a few tweaks should not make much of a difference to their system load.