The attack surface is
far larger than what you specified. Any networking equipment sotting between the client and server(s) can pick up and log IP addresses.
Knowing the online services one uses, and the times (to the millisecond) they used them goes a long way to deanonymize individuals. Correlating Internet routing events is very effective when combined with other data sources, like physical surveillance and knowing the exact times the target got home, or interacted with their phone after getting a DM alert.
