How is it determining which nodes are XT and the total nodes? Can we independently verify?
It is determining through the version string which each node broadcasts. You can verify this by connecting to one of those nodes and checking the version string. However, those can be spoofedWhat is the definition of a node in total nodes? The number seems a bit low.
A full node, which independently verifies each transactions and block before relaying them as well as storing the blockchain on the computer. There are only a few thousand nodes, and not more than 10000.What would it take to launch 1,000 nodes if one wanted to skew the numbers?
one server and a software called Pseudonode can easily spoof thousands of nodes. That giant spike in nodes is caused by someone running pseudonode on a few servers each with several thousand nodes. One server can be several thousand nodes because it can have nodes on different ports. 
