Just kidding - this was a much more clearer response with some actual math behind it, thank you.
This (may) explain a facet of .onion phishing attempts at a certain point in time.