OSINT Deep & Dark Web Investigation 3 — Questions and Answers
Question 1: What is I2P (Invisible Internet Project) primarily used for in dark web investigations?
- Accessing Tor .onion sites faster
- An alternative anonymizing network using garlic routing for internal services (Correct answer)
- A VPN service for journalists
- A blockchain ledger for anonymous transactions
Correct answer: An alternative anonymizing network using garlic routing for internal services
I2P is a separate anonymizing overlay network using garlic routing, primarily designed for internal services called 'eepsites' (.i2p).
Question 2: When investigating dark web forums, what is the OSINT value of analyzing a user's writing style across multiple posts?
- It helps determine the forum's server location
- Stylometric analysis can link anonymous accounts to real identities or other aliases (Correct answer)
- It reveals the user's cryptocurrency wallet address
- It determines whether the forum is a honeypot
Correct answer: Stylometric analysis can link anonymous accounts to real identities or other aliases
Stylometric analysis of vocabulary, grammar patterns, and phrasing can correlate anonymous personas with known individuals or other accounts.
Question 3: Which cryptocurrency is considered more privacy-preserving than Bitcoin and is commonly found in dark web transactions?
- Ethereum
- Litecoin
- Monero (XMR) (Correct answer)
- Ripple (XRP)
Correct answer: Monero (XMR)
Monero uses ring signatures, stealth addresses, and RingCT to obscure sender, receiver, and transaction amounts on its blockchain.
Question 4: What does 'operational security (OPSEC) failure' typically reveal in dark web marketplace investigations?
- Encrypted database credentials
- Personally identifiable information left in metadata, posts, or cross-platform activity (Correct answer)
- Server-side vulnerability scan results
- The total volume of illegal goods sold
Correct answer: Personally identifiable information left in metadata, posts, or cross-platform activity
OPSEC failures expose investigators or subjects through metadata, reused usernames, email addresses, or behavioral patterns across platforms.
Question 5: What is a 'dead drop' in the context of dark web intelligence tradecraft?
- A dark web site that has gone offline
- A method of passing information without direct contact, often via hidden online locations (Correct answer)
- An expired .onion address
- A cryptocurrency transaction that fails to confirm
Correct answer: A method of passing information without direct contact, often via hidden online locations
Dead drops involve leaving information at a pre-arranged location (physical or digital) for retrieval without sender and receiver meeting directly.
Question 6: Which of the following best describes a 'tumbler' or 'mixer' in cryptocurrency investigations?
- A tool that converts Bitcoin to Monero automatically
- A service that pools and redistributes cryptocurrency to obscure transaction trails (Correct answer)
- A blockchain analytics platform
- A dark web escrow service
Correct answer: A service that pools and redistributes cryptocurrency to obscure transaction trails
Tumblers/mixers pool cryptocurrency from multiple users and redistribute different coins to break the transaction trail on public blockchains.
Question 7: In dark web OSINT, what is the purpose of analyzing a forum's registration date and post history timeline?
- To calculate the forum's monthly revenue
- To establish operational patterns, trust levels, and potential connections to real-world events (Correct answer)
- To determine the hosting provider's jurisdiction
- To assess the forum's search engine optimization score
Correct answer: To establish operational patterns, trust levels, and potential connections to real-world events
Timeline analysis reveals actor behavior patterns, periods of inactivity correlating with real events, and escalation of criminal activity.
OSINT Deep & Dark Web Investigation 3
What is I2P (Invisible Internet Project) primarily used for in dark web investigations?