It seems for the attacker to find out about active connections to any given website they have to already know the IP of the website and then brute force the vir

It seems for the attacker to find out about active connections to any given website they have to already know the IP of the website and then brute force the virtual ports. Being able to determine what website the target has an active connection to without prior knowledge would probably take even more brute forcing. A small solice.