We updated the article, especially the origin of the requests. Although the initial observation (private data is leaked to a US server) is still valid.