The Tor project released the criteria they use to flag bad nodes. A long time ago I used to run a somewhat crooked tor exit node that attempted to phish social media users for a limited number of sites (exactly one victim claimed, who's account turned into a big fan of my DJing). The end result of doing so is your exit node gets traffic for somewhere between an hour or two and a few days, just to have traffic slowly drop off.
https://gitlab.torproject.org/tpo/network-health/team/-/wikis/Criteria-for-rejecting-bad-relays
