He is running a custom node, he's looking for double-spend transactions, and mutated transactions are [incorrectly] being classified as double-spend transaction.
Thanks, that I failed to see the thread.
Yea went through the whole thread. Nice to see how he has used grep

. Good work Jan.
HOWEVER
He is trying to attempt to put a number on the double-spends/mutated txs. While it is certainly insightful, it leaves us at the mercy of the attacker when they decide to attack again !!The above scheme/attempt I have proposed can be put into place and the pool (I have a very strong feeling it is a pool) can be identified when the attack starts again.
I am thinking of a simpler variation of the above scheme which should not rely on a custom made client. Until now nobody has come forward to help so its kind of frustrating to be dropping your brains out over this, with hardly any sleep.
Ill try to post it as soon as it comes right in my (tired) mind.