The Dark Web provides a space for privacy, uncensored communication, and activism, enabling individuals to interact beyond the conventional web. However, it is frequently depicted negatively due to its association with illicit activities, i.e., the trade of hacking tools, stolen data, terrorism, drugs, arms dealing, human trafficking, and CSAM, among other violations. Efforts to investigate and de-anonymize suspicious users have struggled due to the Dark Web’s growth and the limitations of existing tools and techniques. This study introduces a novel Dark Web reconnaissance and surveillance framework that leverages custom Python scripts and OSINT tools Hunchly, Onionscan, and Torbot to harvest data from the Dark Web. The framework effectively scrapes hidden service URLs, crawls node information, and collects IP/ email addresses of Dark Web users to derive actionable intelligence and facilitate de-anonymization. The framework encompasses iterative evidence identification, OSINT integration, data analysis, and user behavior profiling. The experimentation demonstrated that the framework offers a robust approach for investigating and de-anonymizing suspicious Dark Web users, assisting in uncovering hidden patterns within Dark Web networks and enhancing the understanding of the Dark Web.