http://invest4k4ufq7x2elistx6xihl7nb3fddzmefp5fsjybyybrmlumoqid.onion/monero-nicehash/index24.html
Along with transaction graph analysis, which may reveal connections between bitcoin addresses (pseudonyms), there is a possible attack which links a user's pseudonym to its IP address. If the peer is using Tor, the attack includes a method to separate the peer from the Tor network, forcing them to use their real IP address for any further transactions.