A single operator got 333 infected Tor exit nodes shut down

How I got over 300 Tor exit nodes removed

On October 2, 333 of Tor's roughly 3,000 exit relays — about 10% of the network — began intercepting SSH connections and harvesting unencrypted mail traffic through an Ebury 1.8.3 backdoor. The author traced every exit relay with an exitmap script and a honeypot, then alerted the Tor Project's network health team. Within days the relays were flagged BadExit and shut down, and the exit count still hasn't recovered.