[mattkirman]

Maybe a botnet has started using Tor for connecting to a central command server? Might help explain a doubling of nodes but minimal traffic increase.