At the most unidea circumstances, you can scan the whole space of "{16 alphanumeric characters}.onion" at a space of 36^16 or around 7x10^24 addresses. That's n

At the most unidea circumstances, you can scan the whole space of "{16 alphanumeric characters}.onion" at a space of 36^16 or around 7x10^24 addresses. That's not feasible. The other attack I've seen is turning on HSDir flag in /etc/tor/torrc and then logging all hidden service descriptors you receive. This method is obviously passive, but it does get the job done according to : http://donncha.is/2013/05/trawling-tor-hidden-services/ http://donncha.is/2013/05/trawling-tor-hidden-services/ Admittedly, I'm relying on my hash.onion for a security via obscurity. And I'm OK with that. Because behind that obscurity is key based ssh and a Node-red configured with https and authentication. Obscurity can be an effective part of overall security, as it lowers the surface area of attack.