Upon examining the individual packets of data being sent back
from the website, we noticed that the headers of some of the
packets reflected a certain IP address not associated with any
known Tor node as the source of the packets.
Smells like parallel construction or "intelligence laundering".
https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...