The onion addresses of hidden services are not themselves secret. The onion address is in fact well known, published in the directory. It's only your server's IP that a hidden service is hiding.
So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.
Tor itself has a nice built-in method of authentication you can use. I don't know of a good howto, but it's documented in the man page. Search for "HiddenServiceAuthorizeClient": https://www.torproject.org/docs/tor-manual.html.en
tl;dr it's possible, and you don't have to rely on crawling the web searching for .onion addresses. You can instead become a HS directory authority, and pick your place in the DHT. Eventually you'd be able to get every address that goes into the DHT.
So please, don't treat knowledge of the onion address itself as a secret! You still have to authenticate to your service in some way.