I may be wrong (and invite correction if so), but I believe .onion addresses do not guarantee anonymity. Servers on the tor network aren't some magical machine

I may be wrong (and invite correction if so), but I believe .onion addresses do not guarantee anonymity. Servers on the tor network aren't some magical machines. They sit in the same datacenter as any other server, and all their traffic reaches them via the internet. Controlling the nodes connected to them should give you a pretty good idea of at least the magnitude of traffic they're seeing. And even without running any nodes, attacking blocks of IPs suspected to include the service while measuring any potential impact on its latency allows you find their public IP (given enough resources and/or time). Then, there's the attack of try