I feel like anyone who has to do anything that “deep cover” is probably doing some hyper aggressive prevention techniques as well like creating a botnet and their own “private” Tor which they recycle machines frequently, or using stolen/compromised VPS and only connecting to it via proxy chains, or something similarly complex.