Tbh, all these sound like obvious noob mistakes. If I'd be trying to fake coming from NY then of course I don't use my russian-language browser or run Javascrip

Tbh, all these sound like obvious noob mistakes. If I'd be trying to fake coming from NY then of course I don't use my russian-language browser or run Javascript code in a non-sandboxed environment that leaks where I am. The login and auto-complete channels don't really work either because all those things use HTTPS/SSL/TLS/... nowadays and you are rarely the endpoint. If you are and they still do this then again, they don't really know what they are doing. It doesn't need a highly skilled+funded state actor to avoid those mistakes.