And for the phishing IPs we could do a tor check for the tot exists that have contacted that particular phishing IP:
https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=160.153.129.223&port=

Scanner is here: https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=

So also consider this: https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=50.63.202.18&port=

pol