VoidAccess

Self-hostable OSINT for turning dark-web research queries into structured threat intelligence. Built for security researchers, threat-intelligence teams, and authorized investigators who need collection, enrichment, relationship mapping, and export in one workflow.

Terminal Output

Quick Start

pip install voidaccess
voidaccess investigate "LockBit ransomware" --no-llm --no-tor --depth shallow
voidaccess list
voidaccess actors
voidaccess status

What It Does

• Parallel collection - searches Tor indexes, paste sites, code forges, security feeds, and curated .onion seeds.
• Entity extraction - finds IOCs, wallets, credentials, handles, vulnerabilities, actors, malware, people, and organizations.
• Multi-source enrichment - adds reputation, breach, passive DNS, sandbox, blockchain, and threat-feed context.
• Actor intelligence - persists aliases, infrastructure, notes, timelines, and cross-investigation relationships.
• Relationship graphs - builds co-occurrence graphs, communities, paths, and infrastructure clusters.
• Content safety - filters prohibited queries, URLs, content, and extracted entities at mandatory pipeline gates.
• Structured exports - produces STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, Markdown, JSON, and IOC packages.
• CLI and web UI - runs locally with SQLite or as a Docker Compose stack with PostgreSQL and a browser interface.

Pipeline

Full pipeline behavior, timeouts, recovery, and data flow are documented in Architecture.

Entity Types

Collection and Enrichment

Sources that need API keys skip cleanly when their keys are absent. The complete key and configuration reference is in Architecture.

Optional vector embeddings

The default installation can run without PyTorch. When the embedding stack is unavailable, VoidAccess logs that it is using a deterministic SHA-256 fallback encoder. Install the optional NLP dependencies to enable full sentence-transformer vector embeddings:

pip install "voidaccess[nlp]"

LLM Providers

CLI Reference

Optional clearnet requests can use ScrapingAnt with --use-scraping-api or --use-proxies; Tor, .onion, GitHub, and GitLab traffic are unaffected.

Self-Hosting

Run the full PostgreSQL, Tor, FastAPI, and Next.js stack with Docker Compose. The self-hosting guide covers guided setup, environment configuration, operations, and troubleshooting.

Links

License

MIT. Use VoidAccess only for authorized security research and threat-intelligence work; see the Usage Policy.