Dark Web Investigations Flashcards

How many characters precede the .onion suffix in a current-generation (v3) Tor onion service address?

Answer: 56

v3 onion addresses are 56 base32 characters that encode the service's ed25519 public key, replacing the 16-character v2 format.

In a standard Tor circuit to a clearnet website, which relay can see the destination site but not the user's real IP address?

Answer: Exit relay

The exit relay decrypts the final onion layer and connects to the destination, but only knows the previous hop, not the originating user.

Investigators linked Silk Road operator Ross Ulbricht to the market partly through which OPSEC mistake?

Answer: He promoted Silk Road on public forums under a handle later tied to his personal Gmail address

Early forum posts as 'altoid' promoting Silk Road were later connected to a post listing rossulbricht@gmail.com.

During the 2017 AlphaBay investigation, what early clue pointed to Alexandre Cazes?

Answer: A personal Hotmail address appeared in the header of the site's password-reset and welcome emails

Early AlphaBay emails exposed the address 'pimp_alex_91@hotmail.com', which was linked to Cazes.

What was unusual about law enforcement's handling of the Hansa market in Operation Bayonet?

Answer: Dutch police covertly took over and operated it for about a month to collect user data

Dutch National Police secretly ran Hansa, capturing user information as AlphaBay refugees migrated there.

Which Monero feature hides the true sender of a transaction among decoy outputs?

Answer: Ring signatures

Ring signatures mix the real input with decoys so observers cannot determine which output was actually spent.

A user connects to a v3 onion service. Approximately how many relays sit between client and service in the combined circuit?

Answer: 6

Client and service each build a 3-hop circuit that meets at a rendezvous point, giving roughly six relays end to end.