That wouldn't explain how they connected the GDID to the visit to the retailers website > Three hours later, the same GDID visited the retailer’s own website,

That wouldn't explain how they connected the GDID to the visit to the retailers website > Three hours later, the same GDID visited the retailer’s own website, through the same Tzulo proxy address used to set up the ngrok account.