Skip to main content

VoidAccess: dark-web threat intel in your browser

Hosted at voidaccess.pro PyPI version Downloads GitHub stars License: MIT

Ask one question. Get a sourced report, a graph you can search, and IOCs you can load.
For security researchers, threat-intel teams, MSSPs and authorized investigators.

Use it hosted → voidaccess.pro  ·  Run it yourself → pip install voidaccess

An investigation on voidaccess.pro: the live view collects and filters dark-web results, then the results open as a searchable graph

Hosted, at voidaccess.pro

Skip the setup. Keep your distance.

The hosted version runs this engine for you. Searches and page fetches go out from our servers through Tor, so your research doesn't start from your laptop or office network. A live view shows every link found, kept or discarded (duplicates, 404s, timeouts, the safety filter), then the results open as a graph with every value searchable by category.

Start free at voidaccess.pro →

How it works

Ask, collect, filter, extract, deliver

One query fans out in parallel to 12+ Tor search engines, code hosts, security feeds and curated .onion seeds, then follows new .onion links as it finds them. Prohibited queries, URLs and content are dropped at mandatory safety gates. The full pipeline, with timeouts and recovery, is in Architecture.

What it finds

Category Examples
Threat actors Actor handles, ransomware groups, malware families, MITRE ATT&CK techniques
Infrastructure IPv4/IPv6, domains, URLs, .onion addresses, file hashes
Crypto wallets Bitcoin, Ethereum, Monero, Litecoin, Zcash, Solana, Tron and more
Credentials Cloud keys, tokens, JWTs, API keys, stealer-log and combo-list entries (masked)
Messaging Telegram, Discord, XMPP, Tox, Session, Matrix, Wire, ICQ, Wickr
Vulnerabilities CVEs, Exploit-DB IDs

Entities are linked into a relationship graph with communities and infrastructure clusters, and cross-referenced against earlier findings.

Nine export formats: STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, JSON, Markdown

Run it yourself

Open source at the core. MIT.
pip install voidaccess
voidaccess configure                      # LLM provider, enrichment keys, Tor
voidaccess investigate "LockBit ransomware"
voidaccess export <id> --format stix     # stix, misp, sigma, yara, snort, suricata, package, csv, md, json

No Tor or LLM key yet? voidaccess investigate "LockBit ransomware" --no-llm --no-tor --depth shallow runs a clearnet-only pass. For the full stack (PostgreSQL, Tor, API and web UI) with Docker Compose, see the self-hosting guide. Python 3.10+.

CLI reference
Command Description
voidaccess investigate "QUERY" Run an investigation
voidaccess show Open the interactive entity browser
voidaccess export ID --format FORMAT Export as STIX, MISP, Sigma, YARA, Snort, Suricata, package, CSV, Markdown or JSON
voidaccess package ID Build an IOC package ZIP
voidaccess enrich ID Re-enrich a saved investigation
voidaccess list List saved investigations
voidaccess status Show configuration, Tor, cache, engine and seed status
voidaccess actors List persistent actor profiles
voidaccess actor HANDLE [--timeline] [--note "TEXT"] Show an actor, its timeline, or add a note
voidaccess configure [llm | keys | tor] Run the setup wizard, or one part of it
voidaccess version Print the installed version

Optional clearnet requests can use ScrapingAnt with --use-scraping-api or --use-proxies; Tor, .onion, GitHub and GitLab traffic are unaffected.

Sources and enrichment
Layer Sources
Dark-web search 12+ Tor search engines and curated .onion seeds
Open-web collection Paste sites, GitHub, GitLab and curated RSS feeds
Threat feeds AlienVault OTX, abuse.ch (MalwareBazaar, ThreatFox, URLhaus), CISA KEV
IP and domain context Shodan InternetDB, GreyNoise, AbuseIPDB, Feodo Tracker, crt.sh, URLScan.io, Wayback Machine, CIRCL PDNS, RDAP
File and identity context VirusTotal, Hybrid Analysis, Have I Been Pwned, EmailRep
Blockchain BlockCypher and Etherscan

Sources that need an API key are skipped cleanly without one. The hosted version uses a subset whose terms allow it. Full configuration: Architecture. For full sentence-transformer embeddings, pip install "voidaccess[nlp]"; without it, a deterministic fallback encoder is used.

LLM providers
Provider Typical models Notes
OpenRouter DeepSeek, Llama, Claude Default route; free models available
Groq Llama Fast hosted inference with a free tier
OpenAI GPT models API key required
Anthropic Claude Claude Haiku is the tested default
Google Gemini Gemini Flash and Pro Google AI Studio key required
Ollama Any installed local model Local, suitable for air-gapped deployments

voidaccess.pro · Self-hosting · Architecture · Contributing · Security · Usage policy · PyPI

License

MIT. Use VoidAccess only for authorized security research and threat-intelligence work; see the Usage Policy.

Metadata

Release files for voidaccess 2.1.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for voidaccess 2.1.1
File Size Uploaded Provenance Actions
voidaccess-2.1.1.tar.gz 3.3 MB Without provenance Details for voidaccess-2.1.1.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for voidaccess 2.1.1
File Interpreter ABI Platform Actions
voidaccess-2.1.1-py3-none-any.whl Python 3 none any Details for voidaccess-2.1.1-py3-none-any.whl

Total release size: 6.4 MB

Release files / voidaccess-2.1.1.tar.gz

Download URL voidaccess-2.1.1.tar.gz
Size 3.3 MB
Tags Source
SHA-256 checksum
How to use checksums
4ba50d96331068ec0e50fbdce11fc6f4d36b61696bcda91e1acd2dd8954db243
BLAKE2b-256 checksum
How to use checksums
e8f9166b8b1e789ecb6226161d593814dadf29405fdd4c66a03649d82e9b3905
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/7.0.0 CPython/3.14.7

Release files / voidaccess-2.1.1-py3-none-any.whl

Download URL voidaccess-2.1.1-py3-none-any.whl
Size 3.1 MB
Tags Python 3
SHA-256 checksum
How to use checksums
bce42352d92a9ca0ba03d8a5b78934f72281f13376c0b23784bed39c31af4cfe
BLAKE2b-256 checksum
How to use checksums
765856b64d98a6cc8c8926b8e032cd2e08aed4f224aebcfbaa5de7222e08516e
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/7.0.0 CPython/3.14.7

Security for voidaccess 2.1.1

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page