And for the phishing IPs we could do a tor check for the tot exists that have contacted that particular phishing IP: https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=160.153.129.223&port=
Scanner is here: https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=
So also consider this: https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=50.63.202.18&port=
pol