[tor-relays] attacks from problematic tor exit relays

I am trying to guess what kind of target attacks are possible through problematic relays.

Suppose the network relay is controlled by the enemy.

How do they determine the original IP address of the outbound traffic? Correlation attacks are possible, but they seem very difficult and probably require a lot of resources. Also, changing the route stops this.

If I assume that they determine what traffic flow is mine, and that I always use the same route, what attacks are possible? Are there any good posts or videos?

-- Sent using MsgSafe.io's Free Plan Private, encrypted, online communication For everyone. https://www.msgsafe.io