The Dark Web, particularly via the Tor network, has undergone significant development to safeguard user privacy and uphold the principles of freedom of speech by offering anonymous routing capabilities. However, it is crucial to acknowledge that the same technology that preserves these rights can also be exploited by cybercriminal elements engaging in illegal activities. Quantifying the extent and character of such illicit activity presents a formidable challenge, primarily because of forestalling attacks in Dark Web Shops. In addressing this challenge, this paper presents an innovative approach designed to assess both the extent and characteristics of illegal commercial activities occurring on the Dark Web. We introduce a novel attack forestalling (AF) algorithm that traces requests originating from VPN servers to identify attack patterns and motivations. The proposed system was evaluated using a dataset containing 10,000 VPN attack logs collected over a period of six months. The results demonstrate significant improvements in attack detection, security, and accuracy over existing cloud-based security mechanisms. The approach involves tracking VPN server attacks, focusing on requests originating from other servers. By solely tracing back these requests, the study aims to shed light on the motivations of potential attackers while also bolstering efforts to prevent their illicit activities. The ultimate goal is to enhance security measures and apprehend individuals involved in cybercriminal activities, thereby promoting a safer and more secure online environment.