Lesson 6.4

Dark Web Intelligence Platforms

Learning Objectives

After this, students can explain why intelligence platforms are the safer way to research the dark web.
After this, students can describe what Flare monitors, how its alerting and remediation work, and how to use its free Flare Academy and Darkroom resources.
After this, students can choose an appropriate free or freemium tool for checking email, domain, or stealer log exposure.
After this, students can name the major paid platforms and what each is known for.
After this, students can evaluate a dark web intelligence platform with a structured set of questions.

Note on numbers: Vendors update their coverage statistics constantly, and different pages on the same site often show different figures. Numbers below are what vendors stated when these notes were written — re-check before presenting them.

1. Why Use a Platform?

Visiting criminal forums, markets, and Telegram channels yourself is risky (legal exposure, malware, scams, illegal content, tipping off threat actors) and slow (sites move, disappear, and require vetting). Dark web intelligence platforms solve this by:

Collecting from underground sources continuously (crawlers, archived data, and in some cases human analysts)
Archiving what they collect, so content is still searchable after a site disappears or a post is deleted
Searching and alerting — you search their copy for your company name, domains, executives, or credentials
Adding context — translation, actor profiles, and links between posts
Driving response — tickets, SIEM alerts, and even automatic password resets

For most organizations and nearly all students, this is the right way to “do” dark web OSINT.

2. Flare (flare.io) — Highlighted Resource

Flare is a threat exposure management platform that combines cyber threat intelligence (CTI), digital risk protection (DRP), and attack surface management across both the clear web and the dark web. It’s a very good resource for this class for two reasons: the platform itself is strong and easy to use, and Flare offers free training and a free hands-on dark web lab that students can use today.

2.1 What Flare monitors

According to Flare’s website:

Source	Coverage Flare cites
Cybercriminal forums	160+ forums globally, on Tor and I2P as well as the clear web
Telegram	127,000+ channels (another Flare page cites 58,000+ cybercriminal channels)
Ransomware leak sites	100+
Stealer logs	159 million+ archived, with over 1 million new logs collected each week (families include RedLine, Raccoon, Vidar, and Lumma)
Leaked credentials	20 billion+
Clear web	GitHub, paste sites, and other open sources
History	Nearly a decade of archived data

2.2 Key capabilities

Real-time alerts when your organization, domains, brands, or executives are mentioned on the dark, deep, or clear web.
Credential and stealer log detection — finds corporate credentials in stealer logs, combolists, and breach datasets so accounts can be reset before attackers use them.
Identity exposure management — maps exposed identities to the services they can reach (Flare calls this “blast radius”), such as Salesforce, GitHub, and AWS.
Automated remediation — integrates with Microsoft Entra ID and Okta to validate an exposure and automatically trigger password resets, session revocations, and account lockdowns. (This is exactly the “revoke sessions, not just passwords” lesson from 6.3-stealer-logs-and-credential-exposure.md.)
Threat Flow — Flare’s generative AI engine that translates multilingual criminal discussions, correlates data across sources, and drafts reports.
Threat intelligence objects — threat actor profiles, URLs, IPs, file hashes, and TTPs.
Integrations — ticketing (Jira, ServiceNow), chat (Microsoft Teams, Slack), identity (Entra ID, Okta), and SIEM (Splunk, Microsoft Sentinel).
Fast setup — Flare says it deploys in 15 to 30 minutes.

2.3 Free trial

Flare offers a free trial that shows your organization’s actual exposure.
Pricing isn’t published; you book a demo or start a trial.
The trial is meant for your own organization. Only use a domain you own or are authorized to represent (e.g., the instructor’s organization with approval) — see Section 6.

2.4 Flare Academy (free)

Flare Academy is Flare’s education hub:
- Expert-led training sessions from Flare’s research team, for both experienced professionals and people just getting started
- An on-demand replay archive (Flare cites 40+ hours of content)
- A Discord community where members can talk directly with Flare researchers
- Original research, threat reports, and guides
- Search results also describe an “Operation: Signal” course that leads to a Flare Cybersecurity Fundamentals certification with CPE credits (verify before class)

2.5 Darkroom (free hands-on lab)

Darkroom, launched in August 2026, is a free, simulated dark web training environment built by Flare Academy. It’s a safe way for students to experience a dark web investigation without going to the dark web.

	Details
Cost	Free — course, community access, and certification
Access	Through the Flare Discord community: register at `flare.io/darkroom`, join the Discord, get verified, then open the lab
Time	About 4 hours for the hands-on lab, self-paced
Who it’s for	Security practitioners, analysts, students, and career-switchers
What you do	Investigate simulated forum threads, analyze stealer log archives and stolen credential databases, triage breaches in an alert console, trace cryptocurrency transactions, examine ransomware operations, and interact with AI-simulated threat actors that respond to your decisions
Topics (7 domains)	Dark web intelligence and forum mechanics; credential supply chain analysis; ransomware economy structures; cryptocurrency forensics; actor attribution; pre-breach intelligence gathering; criminal tradecraft and undercover negotiation
Completion	Pass the assessment to earn a Flare Academy certification, a digital badge, and CPE credits
Extra	Flare ran a live Darkroom experience with a capture-the-flag competition at DEF CON 34

See labs.md for how to use Darkroom as a class assignment.

3. Free & Freemium Tools

Tool	What it does	Free tier	Notes
Hudson Rock (`hudsonrock.com`, `infostealers.com`)	Checks whether an email, username, or domain appears in infostealer logs, with details on infected machines and exposed credentials	Free lookups; free account monitors 3 emails, 3 domains, and 3 usernames with alerts for new infections; free Cavalier Community API (no key required)	Deeper intelligence (Cavalier platform) is paid. `infostealers.com` is run by Hudson Rock’s research team.
SOCRadar Dark Web Report	Free domain-level scan of breach records, dark web forums, stealer logs, credential dumps, and threat actor channels; surfaces leaked emails, passwords, session cookies, and documents tied to a domain	Free; SOCRadar says no account, credit card, or install is required	Designed for organizations (B2B). SOCRadar offers other free tools; the full platform is paid.
Intelligence X (`intelx.io`)	Search engine for emails, domains, IPs, URLs, and keywords across data leaks, paste sites, Tor and I2P content (forums, markets, leak sites), WHOIS, and historical data	Free account with very limited results	Paid tiers are expensive (the Researcher tier starts around €2,500/year). Listed in Bellingcat’s toolkit.
Have I Been Pwned (`haveibeenpwned.com`)	Checks whether an email appears in known breaches; since January 2025, also includes stealer logs	Free email search	Domain search requires proving you control the domain. Seeing which websites appear in stealer logs for a domain requires a paid (Pro 1 or higher) subscription.
SpyCloud “Check Your Exposure”	Checks exposure in SpyCloud’s recaptured darknet data	Free check	Full identity threat protection is paid (see below).
Ahmia (`ahmia.fi`)	Search engine for Tor onion sites, with abusive content filtered	Free	Searchable from a normal browser; opening results needs Tor. Awareness only for this class.
ransomware.live	Monitors ransomware leak sites and tracks published victims	Free	Has an API. Safe way to watch leak sites.
RansomLook	Open-source tracker of ransomware groups, markets, and actors: posts, ransom notes, crypto addresses, mirror URLs	Free	Has an API.

Discontinued: Google’s consumer Dark Web Report stopped scanning on January 15, 2026, and was removed in February 2026. Don’t send students looking for it. Google now points users to Security Checkup, passkeys, Password Manager, and Password Checkup instead.

4. Paid Enterprise Platforms

These usually require a sales demo; some offer trials. Status notes reflect acquisitions as of these notes.

Platform	Known for	Status notes
Flare	Threat exposure management across dark web, Telegram, stealer logs, and clear web; automated identity remediation	Free trial; free Flare Academy and Darkroom
Recorded Future	Broad, AI-driven threat intelligence including dark web collection	Acquired by Mastercard (completed December 20, 2024, for $2.65 billion)
DarkOwl Vision	Large searchable index of darknet, deep web, and high-risk surface web content, via a web app (Vision UI) and API	Denver-based
Flashpoint	Cybercrime and underground community intelligence; says it monitors 1,000+ illicit forums	—
Intel 471	Cybercrime intelligence with an emphasis on human sources inside underground forums; focuses on the actors and groups behind threats	—
KELA	Cybercrime intelligence focused on underground markets and forums, with alerting	—
Cybersixgill	Real-time dark web threat intelligence	Acquired by Bitsight for $115 million (completed December 11, 2024)
ZeroFox	Digital risk protection: brand, executive, and dark web monitoring	Taken private by Haveli Investments ($350 million, completed May 13, 2024)
ReliaQuest GreyMatter Digital Risk Protection	Monitors open, deep, and dark web for data exposure and impersonation; managed takedown service	Formerly Digital Shadows SearchLight; ReliaQuest acquired Digital Shadows in 2022
CrowdStrike Falcon Intelligence Recon	Dark web monitoring within the CrowdStrike Falcon platform: brand and executive protection, data leak discovery, supply chain monitoring	Recon+ is the managed-service version
SpyCloud	“Recaptured” darknet data — credentials, infostealer logs, and stolen session cookies — for identity threat protection and session hijacking prevention	Publishes an annual Identity Exposure Report
DeHashed	Breach data search engine (email, username, IP, password, hash, and more) with an API	Paid credits/subscriptions with a limited free search; third-party sources list pricing starting around $0.02 per query (verify before class)

5. How to Evaluate a Platform

Use these questions when comparing tools (a good small-group exercise — see labs.md).

Area	Questions to ask
Coverage	Which sources: Tor, I2P, clear-web forums, Telegram, Discord, paste sites, ransomware leak sites, stealer logs, code repos? Which languages?
Historical depth	How far back does the archive go? Can I see deleted posts?
Freshness	How quickly do new posts and logs appear?
Search & alerting	Can I search by domain, email, executive name, IP, keyword? Are alerts real-time? How noisy are they?
Context	Translation, actor profiles, analyst notes, risk scoring?
Response	Integrations with SIEM, ticketing, and identity providers? Automated password reset and session revocation? Takedown services?
API	Is there an API, and what does it cost?
Collection ethics	How is the data collected — automated crawling, archived data, human analysts in communities? Does the vendor ever pay criminals for data?
Data handling	Where is data stored? How are plaintext passwords protected? Compliance (GDPR, etc.)?
OPSEC	Are my searches private? Could my queries tip anyone off?
Cost & access	Pricing model, trial, education/community programs?
Usability	Can a junior analyst use it effectively on day one?

6. Using These Tools Responsibly

Only search what you’re authorized to search: your own organization, approved targets, or yourself.
Free trials and free tools expect you to represent the domain you search. HIBP enforces this by requiring domain verification.
Results contain real victims’ data. Look only at what the investigation needs. Never copy plaintext passwords into notes, chats, tickets, or reports — record that a credential was exposed, where, and when.
Store findings securely and delete them when the engagement ends.
Follow the platform’s terms of service (see Module 2 Legal & Ethical Boundaries — the ToS tells you what you’re allowed to do).

Key Terms

Cyber threat intelligence (CTI): Analyzed information about threats and threat actors that helps defenders make decisions.
Digital risk protection (DRP): Monitoring for external threats to an organization’s brand, people, and data (impersonation, leaks, phishing domains).
Attack surface management (ASM): Discovering and monitoring an organization’s internet-facing assets.
Threat exposure management: Flare’s term for combining CTI, DRP, and ASM to find and fix external exposures.
Blast radius: Everything an exposed identity could reach if abused.
Recaptured data: Stolen data that a vendor collects from criminal sources to alert victims.
Takedown service: A service that gets malicious sites or impersonating accounts removed.
CPE credits: Continuing Professional Education credits used to maintain security certifications.

Key Takeaways

Intelligence platforms let you search an archived copy of the underground instead of visiting criminal sites.
Flare monitors forums (Tor and I2P), 100,000+ Telegram channels, ransomware leak sites, and a massive stealer log archive — and can automatically reset passwords and revoke sessions.
Flare Academy and the Darkroom lab are free: about 4 hours of simulated dark web investigation, with a certification at the end.
Free options: Hudson Rock (stealer logs), SOCRadar Dark Web Report, HIBP, Intelligence X (limited), ransomware.live, RansomLook.
Paid leaders include Recorded Future (Mastercard), Flashpoint, Intel 471, KELA, DarkOwl, Cybersixgill (Bitsight), ZeroFox, ReliaQuest, CrowdStrike, and SpyCloud.
Evaluate platforms on coverage, history, freshness, context, response integrations, collection ethics, and cost.
Only search what you’re authorized to search, and never copy plaintext passwords into reports.

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.