If you look at the ISO url, you'll notice something that looks like a short Git SHA hash. That's the exact git checkout of `nixpkgs` used to build the ISO. All system-level artifacts built with nixpkgs wind up with it as part of their name. Very handy.

This means you can plug the sha from the ISO that you link to (nixos-graphical-18.09.776.6a3f5bcb061-x86_64-linux) and get this URL: https://github.com/NixOS/nixpkgs/commits/6a3f5bcb061

And the ISO URL from NixOS.org ([...]/nixos-graphical-18.09.1023.06fb0253afa-x86_64-linux.iso) leads us to https://github.com/NixOS/nixpkgs/commits/06fb0253afa

If you check both, you'll see they're both commits from the upstream `nixpkgs` repository, just a couple weeks apart. So it looks like your torrent is likely an old official ISO that could be upgraded in place the same way the newer ISO would need. (Note, I haven't confirmed that, someone could've uploaded a malicious file with a nice filename, etc. Don't take my word for it, etc.)

(edit: ah, and if I had to guess, the 776 and 1023 as part of the filename is probably the number of commits since the original 18.09 tag was created.)