N-SPEXTRE: Network surveillance and behavior profiling extraction using reconnaissance and OSINT on Dark Web
Krishan Pal Singh · Array · 2026
The Dark Web provides a space for privacy, uncensored communication, and activism, enabling individuals to interact beyond the conventional web. However, it is frequently depicted negatively due to its connection with illicit activities, i.e., hacking tools, stolen data, terrorism, drugs, arms dealing, human trafficking, and Child Sexual Abuse Material, among other violations. Efforts to investigate and identify suspicious users have struggled due to the Dark Web’s growth and the limitations of existing tools and techniques. This study introduces a novel Dark Web reconnaissance and surveillance framework that uses a custom Artifact Ensemble Module and Open-source Intelligence to harvest data from the Dark Web. The N-SPEXTRE framework encompasses iterative evidence identification, evidence preservation, data analysis and correlation, and user behavior profiling. The proposed N-SPEXTRE framework effectively scrapes hidden service URLs, crawls node information, and collects IP/ email addresses of Dark Web users to derive actionable intelligence and facilitate reconnaissance. The experimentation demonstrated that the N-SPEXTRE framework identifies and correlates user aliases, IPs, and other data from 72 Dark Web sites involved in illicit activities. Over 120 days, it tracked user behavior, matching 108 aliases and identifying 473 web links and 1193 proxy addresses.