Ask one question. Get a sourced report, a graph you can search, and IOCs you can load.
For security researchers, threat-intel teams, MSSPs and authorized investigators.
Use it hosted → voidaccess.pro
·
Run it yourself → pip install voidaccess
Hosted, at voidaccess.pro
The hosted version runs this engine for you. Searches and page fetches go out from our servers through Tor, so your research doesn't start from your laptop or office network. A live view shows every link found, kept or discarded (duplicates, 404s, timeouts, the safety filter), then the results open as a graph with every value searchable by category.
Start free at voidaccess.pro →
How it works
One query fans out in parallel to 12+ Tor search engines, code hosts, security feeds and curated .onion seeds, then follows new .onion links as it finds them. Prohibited queries, URLs and content are dropped at mandatory safety gates. The full pipeline, with timeouts and recovery, is in Architecture.
What it finds
| Category | Examples |
|---|---|
| Threat actors | Actor handles, ransomware groups, malware families, MITRE ATT&CK techniques |
| Infrastructure | IPv4/IPv6, domains, URLs, .onion addresses, file hashes |
| Crypto wallets | Bitcoin, Ethereum, Monero, Litecoin, Zcash, Solana, Tron and more |
| Credentials | Cloud keys, tokens, JWTs, API keys, stealer-log and combo-list entries (masked) |
| Messaging | Telegram, Discord, XMPP, Tox, Session, Matrix, Wire, ICQ, Wickr |
| Vulnerabilities | CVEs, Exploit-DB IDs |
Entities are linked into a relationship graph with communities and infrastructure clusters, and cross-referenced against earlier findings.
Run it yourself
pip install voidaccess
voidaccess configure # LLM provider, enrichment keys, Tor
voidaccess investigate "LockBit ransomware"
voidaccess export <id> --format stix # stix, misp, sigma, yara, snort, suricata, package, csv, md, json
No Tor or LLM key yet? voidaccess investigate "LockBit ransomware" --no-llm --no-tor --depth shallow runs a clearnet-only pass. For the full stack (PostgreSQL, Tor, API and web UI) with Docker Compose, see the self-hosting guide. Python 3.10+.
CLI reference
| Command | Description |
|---|---|
voidaccess investigate "QUERY" |
Run an investigation |
voidaccess show |
Open the interactive entity browser |
voidaccess export ID --format FORMAT |
Export as STIX, MISP, Sigma, YARA, Snort, Suricata, package, CSV, Markdown or JSON |
voidaccess package ID |
Build an IOC package ZIP |
voidaccess enrich ID |
Re-enrich a saved investigation |
voidaccess list |
List saved investigations |
voidaccess status |
Show configuration, Tor, cache, engine and seed status |
voidaccess actors |
List persistent actor profiles |
voidaccess actor HANDLE [--timeline] [--note "TEXT"] |
Show an actor, its timeline, or add a note |
voidaccess configure [llm | keys | tor] |
Run the setup wizard, or one part of it |
voidaccess version |
Print the installed version |
Optional clearnet requests can use ScrapingAnt with --use-scraping-api or --use-proxies; Tor, .onion, GitHub and GitLab traffic are unaffected.
Sources and enrichment
| Layer | Sources |
|---|---|
| Dark-web search | 12+ Tor search engines and curated .onion seeds |
| Open-web collection | Paste sites, GitHub, GitLab and curated RSS feeds |
| Threat feeds | AlienVault OTX, abuse.ch (MalwareBazaar, ThreatFox, URLhaus), CISA KEV |
| IP and domain context | Shodan InternetDB, GreyNoise, AbuseIPDB, Feodo Tracker, crt.sh, URLScan.io, Wayback Machine, CIRCL PDNS, RDAP |
| File and identity context | VirusTotal, Hybrid Analysis, Have I Been Pwned, EmailRep |
| Blockchain | BlockCypher and Etherscan |
Sources that need an API key are skipped cleanly without one. The hosted version uses a subset whose terms allow it. Full configuration: Architecture. For full sentence-transformer embeddings, pip install "voidaccess[nlp]"; without it, a deterministic fallback encoder is used.
LLM providers
| Provider | Typical models | Notes |
|---|---|---|
| OpenRouter | DeepSeek, Llama, Claude | Default route; free models available |
| Groq | Llama | Fast hosted inference with a free tier |
| OpenAI | GPT models | API key required |
| Anthropic | Claude | Claude Haiku is the tested default |
| Google Gemini | Gemini Flash and Pro | Google AI Studio key required |
| Ollama | Any installed local model | Local, suitable for air-gapped deployments |
Links
voidaccess.pro · Self-hosting · Architecture · Contributing · Security · Usage policy · PyPI
License
MIT. Use VoidAccess only for authorized security research and threat-intelligence work; see the Usage Policy.
Metadata
Release files for voidaccess 2.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| voidaccess-2.1.1.tar.gz | 3.3 MB | Without provenance | Details for voidaccess-2.1.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| voidaccess-2.1.1-py3-none-any.whl | Python 3 | none | any | Details for voidaccess-2.1.1-py3-none-any.whl |
Total release size: 6.4 MB
Release files / voidaccess-2.1.1.tar.gz
| Download URL | voidaccess-2.1.1.tar.gz |
|---|---|
| Size | 3.3 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
4ba50d96331068ec0e50fbdce11fc6f4d36b61696bcda91e1acd2dd8954db243
|
|
BLAKE2b-256 checksum How to use checksums |
e8f9166b8b1e789ecb6226161d593814dadf29405fdd4c66a03649d82e9b3905
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.7
|
Release files / voidaccess-2.1.1-py3-none-any.whl
| Download URL | voidaccess-2.1.1-py3-none-any.whl |
|---|---|
| Size | 3.1 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
bce42352d92a9ca0ba03d8a5b78934f72281f13376c0b23784bed39c31af4cfe
|
|
BLAKE2b-256 checksum How to use checksums |
765856b64d98a6cc8c8926b8e032cd2e08aed4f224aebcfbaa5de7222e08516e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.7
|
Security for voidaccess 2.1.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.