I wrote an article on bruteforcing Tailscale domain names (code included!): https://yousefamar.com/memo/articles/hacks/tailnet-name/