> because someone scraped TOR and put all of the IP addresses they found on there and tagged them as active threats.

Yeah, or, hear me out... Someone used the exit node for active attacks. (Gasp! What? On my onion?)