Hacker News Reader

I asked this same question on HN a short time ago. The modifications are advanced and not public, so anyone using them is suspected of being related to the same entity. There are also potentially other signature-worthy variables being observed as well.

It's hinted at in the article that these servers are not stock servers, and the author is able to detect similar divergent behavior in all of these nodes, implying they are all the same non-standard tor software that is doing... something.

In one of the articles, the modified servers were noted as also having an email associated that participated in the tor mailing lists.

Another mistake Tor tends to make is assuming 1 IP = 1 server. In theory someone could point 9,000 IP addresses at a single server. In practice this would be obvious when the bandwidth for it sucks, but it could easily be a single cluster of servers in one location with a bunch of addresses routing to it.