 The Illicit Networks category in Flare aggregates data collected from dark web marketplaces, underground forums, ransomware extortion sites, encrypted messaging channels, and infostealer ecosystems.  Together, these sources give you structured visibility into threat actor behavior, data exposure, and active extortion operations before they escalate.

Illicit Networks

 As Flare collects data from various sources, user credentials are continuously extracted from ingested documents and indexed in two places the Event Categories and the Credentials Browser .  Any leaked credentials that match your configured Identifiers are automatically added to your Tenant feed, enabling you to actively monitor for exposures directly affecting your organization.

Leaked Credentials Events

Event Categories

Search with AI

Advanced Search

Search in Existing Data

Understand Event Severity

Forum Thread Intelligence

Network

Actor Intelligence

Open Ports

Events

Flare

docs.flare.io

Welcome to Flare!

What We Are Working On

Get Started

Unresolved Events

Event Trends

Event Explorer

Identifier Trends

Dashboard

Respond to Leaked Credentials Events

Respond to Look-alike Domains Events

Respond to Open Web Events

Respond to .ph Domain Alerts

Respond to Illicit Networks Events

Playbooks

Flare Executive and VIP Monitoring

GUIDES

Actions

Email Alerts

Alert Central

Configure Identifiers

Configure Identifiers - Advanced

Identifier Recommendations

Policies

Identifiers - Listing Subdomains

Rate-limiting of identifier event feeds

Identifiers

Collection Overview

Telegram Channels

Breaches

Collection Data Categories

Collection

Scheduled Reports

Reports Migration FAQ

Reports

Global Search - Quota

Global Search

Supply Chain Ransomware Exposure Monitoring

Takedown Services

Account and Session Takeover Prevention

CORE FEATURES

IEM Okta Setup

IEM Entra ID Setup

IEM Credential Browser

Identity Profile

IEM FAQ

Identity Exposure Management Overview

Use Cases

Credentials Browser

IDENTITY EXPOSURE

Intelligence Browser

Threat Flow

Enterprise IOC Feed

Sandbox

The CTI Module

THREAT INTELLIGENCE

Integrations Hub

Tenants

Team

Usage

Audit Logs

Roles & Permissions

Profile

SSO SAML Configuration

SSO and Authentication

Pre-Sales Tenants

CONFIGURE FLARE

Azure Sentinel IOC Feed Setup

Sentinel Integration

Azure Sentinel Integration (Legacy)

Discord

Jira

Microsoft Entra ID

ServiceNow

Slack

Splunk Cloud (Legacy)

Splunk App

Microsoft Teams

Webhooks

INTEGRATIONS

Source Code Secret Detection

Open Web

Leaked Credentials

Permutation strategies

Look-alike Domains

Emerging Sources

DATA SOURCES

Product Specifications

Fraudster Jargon

Data Fields

Queries

Event Date Fields

Asset Relations

REFERENCES

RESEARCH CENTER