Why must this be malicious? It could be a researcher, or someone interested in building a hidden service index, etc.
Given that, I think a case could be made that even doing this for research is acting in bad faith, if not "malicious."
Basically, if you don't want people to know that you're running a service over Tor then you're relying on a guarantee that isn't there. If you want to hide your location while announcing that you're running a service then you're relying on a guarantee that Tor actually claims to provide.
If this is research then given the above how is it "in bad faith" or "malicious"?
you shouldn't assume HSDir is private in any case; and if enumeration
is truly a concern, fast flux onions is a thing. these are location
hidden, not existence hidden :)Perhaps these "fast flux onions" should be called "green onions". :)
This is very likely not related to Op Onymous.