He's being intentionally vague. The attacker is obviously aware of his posts. If he reveals how he is indentifying the relays, they will change according.

If you read between the lines, he gives a few hints with regards to the sslstripping and traffic manipulation on only a limited set of sites.

This is from another post @ https://medium.com/@nusenu/the-growing-problem-of-malicious-...:

> In autumn 2019 I stumbled on something odd: Tor relays doing something that the official tor software is unable to do. This is intentionally vague to avoid giving away the detection methodology to the adversary."