Does deepnet have only 7100 onion sites?

Question

I have read this article on forbes claiming that deepnet has only 7100 onion sites and took only 3 hours to scan completely.

Which to me sounds like total nonsense since if average .onion address is 16 long (example: http://3g2upl4pq6kufc4m.onion/) and can be made up from numbers and letters

Then possible combinations are 65536*(27+10)^16 = 8.0855118e+29 (ports *(letters + numbers)^symbol_count) which if they would scan 65536 addresses per second (they would need to wait at least one second for response my understanding is that one can only open 65536 connections per machine simultaneously) to scan entire range of addresses they would need 3*60*60*65536 = 707788800 (hours*minutes*seconds*connections_scanning_at_one_time) They would need (65536*(27+10)^16)/(3*60*60*65536) = 1.1423622e+21 machines, which I doubt they have.

Could they have made a scan of all the .onion websites in 3 hours?

I have first asked this question on SO skeptics, but it was suggested that it better fits here.

One of comments was that limitation of 64k simultaneous scans does not apply, still amount of possible addresses is astronomical.

You might want to have a look at programs like zmap, which is the fastest way of scanning things (no 64k connections limitation). Another approach to estimate a minimal time would be to take the data needed for a proper handshake and multiply and then divide by the fattest line you have available. – PlasmaHH

Answer 1

Your calculation is not fully correct. The hidden service address is encoded in Base32, which means there are 32 characters available. So there are 32^16=1.208925819614629174706176×10^24 addresses available. Even if you assume that someone has 10 billion machines and each machine needs a second for a test the whole experiment would need nearly four million years.

https://ahmia.fi is a search engine which indexes hidden services. They have a bit more than 5000 addresses in their database. The Tor metrics page knows about nearly 30.000 unique onion addresses:

So the number of 7100 might be feasable.

Answer 2

7100 sounds about right for the number of hidden web services that are up at any given time. It actually sounds a bit high.

The 30K from Tor metrics are the aggregate data from HSDirs. The fact that a hidden service is hosted/registered on the Tor network does not mean that it points to an actual live server.

'Scanning' all possible addresses is not the way to find out. It is just impossible. I believe that ahmia.fi uses a combination of HSDir data and crawling/spidering. That should find pretty much everything.

3 hours also sounds plausible, but I do think (and hope) that they used more than one Guard.
(Let's say 5 clients * 6 parallel connections per client / 10 seconds per connection = 3 connections per second.)

Answer 3

Could they have made a scan of all the .onion websites in 3 hours?

It is impossible in the way of brute-force attack. Because you can not check all possible variants of .onion's names. It is too many at the First and at the Second - Tor's bandwidth simply will do not give you a chance for this. You must remember, it is not an Internet, it is much-much slower.

Finally, HS designed in such way that founder of .onion could hide its existence.

There are many answered questions here about this. You can't get the list of all onions, there is no one.

In light of this, we can assume that there are 10,000 onions or 20,000 onions web sites on-line and only 7,000 are public, others are hidden / private.