Perhaps I have misphrased. And perhaps I misunderstand.
What I meant (and, agreed, whonix is using torbrowser, and this is a tor/torbrowser only, not whonix, thing) …
er, torbrowser uses tor, and only tor is relevant to this conversation … (?)
If I understand correctly, every 10 minutes, tor changes it’s path through the cloud. Different entry, middle, and/or exit nodes are chosen.
And, over time, good tor nodes will detect and refuse to connect to bad tor nodes.
So, in essence:
I believe whonix already has defensive measure in place for protection from bad TOR nodes, effected at the next routing change
To Patrick’s point … replace ‘whonix’ with ‘tor’, above.
IIUC.