<p><pre><code> Upon examining the individual packets of data being sent back
from the website, we noticed that the headers of some of the
packets reflected a certain IP address not associated with any
known Tor node as the source of the packets.
</code></pre>
Smells like parallel construction or "intelligence laundering".<p><a href="https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intelligence-laundering" rel="nofollow">https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...</a>