A Tor .onion site can be found in a manner similar to a DNS request. A Tor address resolves to 3 IP addresses called Instruction Points (IPT). A directory server contains information about the hidden service. The hidden service uses random IPT nodes to upload its information to the directory server. The client the requests information of the onion service from the directory server. The client and server are then connected through a random rendezvous point to relay communications between the client and server. Hidden services have a beacon pattern that can be identified.
