[aaron42net]

Previously when the Wired article was mentioned on HN (https://news.ycombinator.com/item?id=5089703), I did some digging and found that aaronsw.com and tor2web.org were hosted on the same Linode instance IP.

While the sniffing could've happened at any Tor exit node, Tor2web is an insecure public interface into the Tor network and is uniquely positioned to sniff any traffic passing through it. Aaron Swartz could've had tor2web.org record any requests made through it and supplied any interesting results to Wikileaks.