http://maldomapyy5d5wn7l36mkragw3nk2fgab6tycbjlpsruch7kdninhhid.onion
It is likely that there are many more spy nodes in the second and third typologies that are not known to us. The second and third typologies might also be involved in botnets or could be spy nodes. To determine if an IP address is involved in any ongoing botnets, we would need access to more OSINT sources that are unavailable to us since there are only available on the clearnet.