My question is about the ways to discover new hidden (.onion) websites. With regular Internet domain names, we have search engines that crawl the web, and we can also resort to additional techniques such as:

  1. using zone files when available for the TLD
  2. using lists published by the respective registries
  3. using certificate transparency logs
  4. mining DNS requests (public resolvers must exit for that reason too)

These options are ruled out for Tor, except #3 (for the few .onion sites that use certificates).

When V2 addresses were in use, it was possible to "sniff" on requests by running a Tor relay, but such practice is against the (old) ethical guidelines of the Tor project:

It is not acceptable to run an HSDir, harvest onion addresses, and publish or connect to those onion addresses.

I understand that with V3 addresses, this technique is now ineffective although there is ongoing research on the topic eg:

What are the options left for legitimate Darknet and security research? Some hidden services obviously don't want to be found, or don't want to be seen by people "not in the know" so they won't advertise their presence loudly. Yet there are legitimate reasons (beyond mere curiosity) for wanting to find them.

1 Answer 1


In my opinion - one of the reasons of V3 addresses to come up is to prevent this kind of intrusions, and it's for good. The very core of the "hidden service" idea is that the service is hidden :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .