VoidAccess is an open-source OSINT platform designed to automate dark web research workflows into structured threat intelligence. Built for security researchers, threat-intelligence teams, and authorized investigators, it integrates collection, enrichment, relationship mapping, and export in a single tool.
The platform operates through a 13-stage pipeline. It begins by refining investigation queries using optional LLM assistance, then collects data in parallel from Tor search engines, paste sites, code forges, RSS feeds, and curated .onion seeds. After filtering noise, it enriches results against threat-intelligence sources and recursively discovers additional .onion links. Selected pages are fetched through Tor with response-size limits, and newly collected content is persisted. The system then merges collected and enriched intelligence, extracts entities using regex, named-entity recognition, and optional LLM analysis, and cross-references them against historical datasets before building relationship graphs and generating final summaries.
VoidAccess extracts multiple indicator categories: cryptocurrency addresses (Bitcoin, Ethereum, Monero, and others); network indicators (IPv4, IPv6, domains, .onion addresses); file indicators (hashes and malware families); credentials (API keys, tokens, stealer logs); messaging handles (Telegram, Discord, XMPP, Session, Matrix); vulnerabilities (CVEs, MITRE ATT&CK techniques); detection content (YARA rules, Snort signatures); and threat intelligence (actor handles, ransomware group names, people, organizations).
Data sources include 16+ Tor search engines, open-web paste sites (Pastebin, GitHub, GitLab), threat feeds (AlienVault OTX, abuse.ch, MalwareBazaar, CISA KEV), IP and domain context providers (Shodan, GreyNoise, URLScan.io, Wayback Machine), file and identity services (VirusTotal, Have I Been Pwned), and blockchain explorers (BlockCypher, Etherscan). Missing API keys skip cleanly without blocking operation.
The tool supports multiple LLM providers including OpenRouter, Groq, OpenAI, Anthropic, Google Gemini, and local Ollama. It can run as a CLI with SQLite or as a full Docker Compose stack with PostgreSQL and a browser interface. Exports support STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, Markdown, JSON, and IOC packages. Optional PyTorch and sentence-transformer embeddings enable advanced NLP capabilities; a SHA-256 fallback encoder runs by default. The project is MIT-licensed and requires authorized use under its usage policy.
Key facts
- VoidAccess automates dark web research into structured threat intelligence through a 13-stage pipeline
- Extracts multiple indicator types: cryptocurrency, network indicators, credentials, malware hashes, messaging handles, CVEs, YARA rules, and actor profiles
- Integrates 16+ Tor search engines, open-web paste sites, threat feeds, IP/domain context, blockchain explorers, and enrichment services
- Supports multiple LLM providers (OpenRouter, Groq, OpenAI, Anthropic, Google Gemini, Ollama) with optional local deployment
- Exports to STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, Markdown, and JSON formats
- Runs as CLI with SQLite or full Docker Compose stack with PostgreSQL and web UI
- MIT-licensed with mandatory authorized-use policy