If I understand it correctly, a node does not need to be acting malicious, it only needs to cooperate with other compromised nodes.
I get that the Tor Project has banned relays for numerous reasons. The tor-relays list is a good (albeit incomplete) source for reports, discussion and decisions.