> She/he told me that they are a small group (maybe from China) trying to catch pedophiles;

If they indeed are from china, I'd say it's just as likely they're trying to catch people who evade the censorship or press rules.

DNS servers for the domain are ns1.ipchina163.com and ns2.ipchina163.com, but these as well as the site itself appear to be in Malaysia.

It's all in the game

Link is a 404, here's the correct one:

http://dustri.org/b/torbundlebrowserorg.html

http://cuckoosandbox.org/ looks interesting, as does the way of detecting it.

Well, I didn't read the part where OP stated that he was doing a right...

The server is running outdated services, and is powered by cPanel.

What is wrong?

More info on the source of this is a good thing, IMHO

yeah better than implementing tcp stack in python :D