[dijit]

tor exit nodes are easy to identify, if they had the co-operation of site.com then they'd not see the location, but they'd see the exit node.

[talmand]

I can understand they can the attack was done through Tor, what I don't understand is how they understood the attack originated on their own network through Tor.