CCI Dark Web Investigations 2

Question 1

How many characters precede the .onion suffix in a current-generation (v3) Tor onion service address?

Accepted Answer

56

Answer

v3 onion addresses are 56 base32 characters that encode the service's ed25519 public key, replacing the 16-character v2 format.

Question 2

In a standard Tor circuit to a clearnet website, which relay can see the destination site but not the user's real IP address?

Accepted Answer

Exit relay

Answer

The exit relay decrypts the final onion layer and connects to the destination, but only knows the previous hop, not the originating user.

Question 3

Investigators linked Silk Road operator Ross Ulbricht to the market partly through which OPSEC mistake?

Accepted Answer

He promoted Silk Road on public forums under a handle later tied to his personal Gmail address

Answer

Early forum posts as 'altoid' promoting Silk Road were later connected to a post listing rossulbricht@gmail.com.

Question 4

During the 2017 AlphaBay investigation, what early clue pointed to Alexandre Cazes?

Accepted Answer

A personal Hotmail address appeared in the header of the site's password-reset and welcome emails

Answer

Early AlphaBay emails exposed the address 'pimp_alex_91@hotmail.com', which was linked to Cazes.

Question 5

What was unusual about law enforcement's handling of the Hansa market in Operation Bayonet?

Accepted Answer

Dutch police covertly took over and operated it for about a month to collect user data

Answer

Dutch National Police secretly ran Hansa, capturing user information as AlphaBay refugees migrated there.

CCI - Certified Cryptocurrency Investigator Practice Test