Self-hostable OSINT for turning dark-web investigation queries into organized danger intelligence. Built for safety researchers, threat-intelligence teams, and authorized investigators who need collection, enrichment, association mapping, and export in one workflow.
pip instal voidaccess voidaccess examine "LockBit ransomware" --no-llm --no-tor --depth shallow voidaccess list voidaccess actors voidaccess status
- Parallel collection - searches Tor indexes, paste sites, code forges, safety feeds, and curated .onion seeds.
- Entity extraction - finds IOCs, wallets, credentials, handles, vulnerabilities, actors, malware, people, and organizations.
- Multi-source enrichment - adds reputation, breach, passive DNS, sandbox, blockchain, and threat-feed context.
- Actor intelligence - persists aliases, infrastructure, notes, timelines, and cross-investigation relationships.
- Relationship graphs - builds co-occurrence graphs, communities, paths, and infrastructure clusters.
- Content safety - filters prohibited queries, URLs, content, and extracted entities at mandatory pipeline gates.
- Structured exports - produces STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, Markdown, JSON, and IOC packages.
- CLI and web UI - runs locally alongside SQLite or as a Docker Compose stack alongside PostgreSQL and a browser interface.
| Stage | Action |
|---|---|
| 1 | Refine the inquiry query alongside the selected LLM |
| 2 | Collect from Tor search, paste sites, code forges, RSS feeds, and curated seeds in parallel |
| 3 | Filter noisy or irrelevant pages |
| 4 | Enrich the query and first indicators from threat-intelligence sources |
| 5 | Discover additional .onion links recursively |
| 6 | Reuse lately processed pages from the vector cache |
| 7 | Fetch selected pages through Tor alongside response-size limits |
| 8 | Persist newly collected content |
| 9 | Merge collected and enriched intelligence |
| 10 | Extract entities alongside regex, NER, and optional LLM analysis |
| 11 | Cross-reference entities against historic and kernel datasets |
| 12 | Build relationships, communities, and infrastructure clusters |
| 13 | Generate the final intellect summary and export-ready result |
Full pipeline behavior, timeouts, recovery, and data stream are documented in Architecture.
| Category | Examples |
|---|---|
| Cryptocurrency | Bitcoin, Ethereum, Monero, Litecoin, Zcash, Solana, Tron, ENS |
| Network indicators | IPv4, IPv6, domains, URLs, .onion addresses, MAC addresses, PGP keys |
| File indicators | MD5, SHA-1, SHA-256, malware families |
| Credentials | Cloud keys, tokens, JWTs, API keys, stealer logs, combo-list entries |
| Messaging | Telegram, Discord, XMPP, Tox, Session, Matrix, Wire, ICQ, Wickr |
| Vulnerabilities | CVEs, MITRE ATT&CK techniques and tactics, Exploit-DB IDs |
| Detection content | YARA rules, Nuclei templates, Snort and Suricata indicators |
| Threat intelligence | Actor handles, ransomware groups, paste links, people, organizations, locations |
| Layer | Sources |
|---|---|
| Dark-web search | 16+ Tor hunt engines and curated .onion seeds |
| Open-web collection | Pastebin, dpaste, paste.ee, Rentry, GitHub, GitLab, and curated RSS feeds |
| Threat feeds | AlienVault OTX, abuse.ch, MalwareBazaar, ThreatFox, URLhaus, ransomware.live, CISA KEV |
| IP and domain context | Shodan InternetDB, GreyNoise, AbuseIPDB, Feodo Tracker, C2IntelFeeds, crt.sh, URLScan.io, Wayback Machine, CIRCL PDNS, RDAP |
| File and character context | VirusTotal, Hybrid Analysis, Have I Been Pwned, EmailRep |
| Blockchain | BlockCypher and Etherscan |
Sources that need API keys skip cleanly whenever their keys are absent. The complete key and configuration citation is in Architecture.
The default facility can run without PyTorch. When the embedding stack is unavailable, VoidAccess logs that it is using a deterministic SHA-256 fallback encoder. Install the optional NLP requirements to allow full sentence-transformer vector embeddings:
pip instal "voidaccess[nlp]"| Provider | Typical models | Notes |
|---|---|---|
| OpenRouter | DeepSeek, Llama, Claude | Default route; liberated models are available |
| Groq | Llama | Fast hosted conclusion alongside a liberated tier |
| OpenAI | GPT models | API key required |
| Anthropic | Claude | Claude Haiku is the tested default |
| Google Gemini | Gemini Flash and Pro | Google AI Studio key required |
| Ollama | Any installed local model | Local and suitable for air-gapped deployments |
| Command | Description |
|---|---|
| voidaccess examine "QUERY" | Run an investigation |
| voidaccess show | Open the interactive being browser |
| voidaccess export INVESTIGATION_ID --format FORMAT | Export as STIX, MISP, Sigma, YARA, Snort, Suricata, package, CSV, Markdown, or JSON |
| voidaccess bundle INVESTIGATION_ID | Build an IOC bundle ZIP |
| voidaccess enrich INVESTIGATION_ID | Re-enrich a saved investigation |
| voidaccess list | List saved investigations |
| voidaccess status | Show configuration, Tor, cache, engine, and kernel status |
| voidaccess actors | List persistent performer profiles |
| voidaccess performer HANDLE | Show an performer profile |
| voidaccess performer HANDLE --timeline | Show an performer action timeline |
| voidaccess performer HANDLE --note "TEXT" | Add an expert note to an performer profile |
| voidaccess timeline HANDLE | Open an performer timeline directly |
| voidaccess configure | Run the setup wizard |
| voidaccess configure llm | Configure the LLM provider, model, and key |
| voidaccess configure keys | Configure enrichment API keys |
| voidaccess configure tor | Override the Tor proxy presenter and port |
| voidaccess version | Print the installed version |
Optional clearnet requests can use ScrapingAnt alongside --use-scraping-api or --use-proxies; Tor, .onion, GitHub, and GitLab traffic are unaffected.
Run the complete PostgreSQL, Tor, FastAPI, and Next.js stack alongside Docker Compose. The self-hosting guide covers guided setup, surroundings configuration, operations, and troubleshooting.
| Self-hosting guide | Docker Compose, surroundings setup, operations, and troubleshooting |
| Architecture | Pipeline internals, modules, schema, API, enrichment, graph, and configuration reference |
| Contributing | Development setup, standards, and drag requests |
| Security | Supported versions and personal exposure reporting |
| Usage policy | Authorized-use requirements and prohibited activity |
| PyPI | Published bundle and publish files |
| GitHub | Source, issues, and releases |
MIT. Use VoidAccess lone for authorized safety investigation and threat-intelligence work; see the Usage Policy.
