At the most unidea circumstances, you can scan the whole space of &quot;{16 alphanumeric characters}.onion&quot; at a space of 36^16 or around 7x10^24 addresses. That&#x27;s not feasible.<p>The other attack I&#x27;ve seen is turning on HSDir flag in &#x2F;etc&#x2F;tor&#x2F;torrc and then logging all hidden service descriptors you receive. This method is obviously passive, but it does get the job done according to : <a href="http:&#x2F;&#x2F;donncha.is&#x2F;2013&#x2F;05&#x2F;trawling-tor-hidden-services&#x2F;" rel="nofollow">http:&#x2F;&#x2F;donncha.is&#x2F;2013&#x2F;05&#x2F;trawling-tor-hidden-services&#x2F;</a><p>Admittedly, I&#x27;m relying on my hash.onion for a security via obscurity. And I&#x27;m OK with that. Because behind that obscurity is key based ssh and a Node-red configured with https and authentication. Obscurity can be an effective part of overall security, as it lowers the surface area of attack.