This seems very similar to the idea of having private exit nodes: https://www.torproject.org/docs/faq#HideExits It's also easy to enumerate Exit IPs not by scanning up/down, by just building a circuit through every exit node to a server you control, and looking at the originating IP. -tom