Journal of Cybersecurity and Information Management JCIM 2690-6775 2769-7851 10.54216/JCIM https://www.americaspg.com/journals/show/3124 2019 2019 Department of Computer Science and Engineering, Koneru Laxmaiah Education Foundation, Vaddeswaram, AP, India Vinod Vinod Department of Computer Science and Engineering, Koneru Laxmaiah Education Foundation, Vaddeswaram, AP, India KVD Kiran This study is centered on the possible methods to analyze and investigate dark web crimes by technical and non-technical users such as law enforcement agencies. Also, the study focuses on learning anonymity procedures used by malicious actors to hide their identity on the dark web and identify the challenges to making a network-level investigation. The other objective is to study the proven methods to determine the hidden services directory (HSDir), active marketplaces, crawling and indexing of the dark web pages. Methods: A Proof of Concept (PoC) experiment explores multi-level anonymity techniques used by malicious actors. Level one involves using a commercial VPN to hide system details, and level two employs a hypervisor, MAC changer, proxy server, and the Tor network. The results reveal the complexities of Tor anonymity and provide insights into the methods employed by malicious actors. The proposed methodology offers a comprehensive approach to understanding and investigating dark web crimes, combining website fingerprinting, open-source intelligence, and threat intelligence data. Findings: Investigation teams face challenges as the proven and tested methods of previous works in this study, such as network-level bulk datasets and webpages fingerprinting dataset analysis, are technology-intensive and non-technical users will face challenges. Usage of Anonymous tools and techniques used at the host level (VM), Mac change, VPN and Tor network complicates the investigation to track and trace the activities. Tor browser has hopped through random nodes to anonymize the connection before connecting to the marketplace. MAC Changer will change the Mac address flashed on the network card by the device manufacturer to anonymize the system-level details. Novelty: Identified the requirement of a comprehensive and novel methodology that is adaptable to investigate dark web crimes by the technical and non-technical teams of law enforcement an agency is proposed in this study. This methodology includes website fingerprinting, OSINT and threat intelligence data collected from various sources. This methodology shall evolve with phase-wise steps of proven techniques such as crawling, indexing, attribute-based analysis, and dataset creation to obtain actionable intelligence proposed in this paper to investigate and eradicate dark web crimes. 2025 2025 166 178 10.54216/JCIM.150113 https://www.americaspg.com/articleinfo/2/show/3124