> Tor exit nodes were far more likely to contain malicious requests That's comparing apples to oranges though. A lot of different people send requests from tor

> Tor exit nodes were far more likely to contain malicious requests That's comparing apples to oranges though. A lot of different people send requests from tor exit nodes. That might be comparable to some corporate networks, but many IP addresses are used by only one person (or a family). Intuition would suggest that tor traffic is more likely to be malicious than average traffic, but suppose there are 500 tor exit nodes in the world, and 1 malicious tor user: then 1 in 500 tor-exit node IPs would have sent a malicious request!