This is interesting, well written up and even has a nice proof of concept. Nicely done! A fun countermeasure would be to change the device hostname to somethin

This is interesting, well written up and even has a nice proof of concept. Nicely done! A fun countermeasure would be to change the device hostname to something like atemptingurl.local that entices the attacker to try visiting that website where a webpage is carefully crafted to run the exact same technique on them and return: "Hi [hacker's device name]! Your machine information, IP address, geolocation and other fingerprint information has been captured and reported to [insert scary cyber agency here]." Even if they are seasoned veterans rather than script kiddies, it could at least give them a smile. People need more reasons to smile. :-)