Here is a technique that is used to uncover hidden services:
1. purchase VPS products at a bunch of providers who accept bitcoin / crypto
2. ddos your target
3. see if you notice any of your hosted boxes go down
4. once you know the provider pop them (they're usually running some shitty WHMCS or similar homebrew solution, old Cpanel, etc. etc. and they're almost always resellers and amateurs) and move laterally to your target
When the feds do it against online drug markets (and they have been for years) they have the bonus of having decent network insight / view by working with backbone providers
1. purchase VPS products at a bunch of providers who accept bitcoin / crypto
2. ddos your target
3. see if you notice any of your hosted boxes go down
4. once you know the provider pop them (they're usually running some shitty WHMCS or similar homebrew solution, old Cpanel, etc. etc. and they're almost always resellers and amateurs) and move laterally to your target
When the feds do it against online drug markets (and they have been for years) they have the bonus of having decent network insight / view by working with backbone providers
There is just no way to hide multi-Gb of traffic