Where do you have the information from that "all malicious traffic attempts to use privacy respecting technology."? I just checked an access.log (from a searx instance) and an auth.log for malicious traffic and it doesn't look at all like that.

ssh bruteforce top 5 offenders:

147 (Tor: 0) TENCENT-NET-AP-CN

133 (Tor: 0) DIGITALOCEAN-ASN

31 (Tor: 0) CHINANET-BACKBONE

17 (Tor: 0) BAIDU

13 (Tor: 0) CHINANET-SH-AP

Overall there where 737 unique IPs from 241 ASNs and 1 was a Tor node.

access log top 5 offenders:

76 (Tor: 0) DIGITALOCEAN-ASN

58 (Tor: 0) CONTABO

54 (Tor: 0) AMAZON-AES

50 (Tor: 0) KAZTELECOM-AS

34 (Tor: 0) CORBINA-AS

Overall there where 1672 unique IPs from 618 ASNs and 4 where Tor nodes.