Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
Self-hostable OSINT for turning dark-web research queries into structured threat intelligence. Built for security researchers, threat-intelligence teams, and authorized investigators who need collection, enrichment, relationship mapping, and export in one workflow.
pip install voidaccess
voidaccess investigate "LockBit ransomware" --no-llm --no-tor --depth shallow
voidaccess list
voidaccess actors
voidaccess status
.onion seeds.Full pipeline behavior, timeouts, recovery, and data flow are documented in Architecture.
Sources that need API keys skip cleanly when their keys are absent. The complete key and configuration reference is in Architecture.
The default installation can run without PyTorch. When the embedding stack is unavailable, VoidAccess logs that it is using a deterministic SHA-256 fallback encoder. Install the optional NLP dependencies to enable full sentence-transformer vector embeddings:
pip install "voidaccess[nlp]"
Optional clearnet requests can use ScrapingAnt with --use-scraping-api or --use-proxies; Tor, .onion, GitHub, and GitLab traffic are unaffected.
Run the full PostgreSQL, Tor, FastAPI, and Next.js stack with Docker Compose. The self-hosting guide covers guided setup, environment configuration, operations, and troubleshooting.
MIT. Use VoidAccess only for authorized security research and threat-intelligence work; see the Usage Policy.
| Stage | Action |
|---|
| 1 | Refine the investigation query with the selected LLM |
| 2 | Collect from Tor search, paste sites, code forges, RSS feeds, and curated seeds in parallel |
| 3 | Filter noisy or irrelevant pages |
| 4 | Enrich the query and early indicators from threat-intelligence sources |
| 5 | Discover additional .onion links recursively |
| 6 | Reuse recently processed pages from the vector cache |
| 7 | Fetch selected pages through Tor with response-size limits |
| 8 | Persist newly collected content |
| 9 | Merge collected and enriched intelligence |
| 10 | Extract entities with regex, NER, and optional LLM analysis |
| 11 | Cross-reference entities against historical and seed datasets |
| 12 | Build relationships, communities, and infrastructure clusters |
| 13 | Generate the final intelligence summary and export-ready result |
| Category | Examples |
|---|
| Cryptocurrency | Bitcoin, Ethereum, Monero, Litecoin, Zcash, Solana, Tron, ENS |
| Network indicators | IPv4, IPv6, domains, URLs, .onion addresses, MAC addresses, PGP keys |
| File indicators | MD5, SHA-1, SHA-256, malware families |
| Credentials | Cloud keys, tokens, JWTs, API keys, stealer logs, combo-list entries |
| Messaging | Telegram, Discord, XMPP, Tox, Session, Matrix, Wire, ICQ, Wickr |
| Vulnerabilities | CVEs, MITRE ATT&CK techniques and tactics, Exploit-DB IDs |
| Detection content | YARA rules, Nuclei templates, Snort and Suricata indicators |
| Threat intelligence | Actor handles, ransomware groups, paste links, people, organizations, locations |
| Layer | Sources |
|---|
| Dark-web search | 16+ Tor search engines and curated .onion seeds |
| Open-web collection | Pastebin, dpaste, paste.ee, Rentry, GitHub, GitLab, and curated RSS feeds |
| Threat feeds | AlienVault OTX, abuse.ch, MalwareBazaar, ThreatFox, URLhaus, ransomware.live, CISA KEV |
| IP and domain context | Shodan InternetDB, GreyNoise, AbuseIPDB, Feodo Tracker, C2IntelFeeds, crt.sh, URLScan.io, Wayback Machine, CIRCL PDNS, RDAP |
| File and identity context | VirusTotal, Hybrid Analysis, Have I Been Pwned, EmailRep |
| Blockchain | BlockCypher and Etherscan |
| Provider | Typical models | Notes |
|---|
| OpenRouter | DeepSeek, Llama, Claude | Default route; free models are available |
| Groq | Llama | Fast hosted inference with a free tier |
| OpenAI | GPT models | API key required |
| Anthropic | Claude | Claude Haiku is the tested default |
| Google Gemini | Gemini Flash and Pro | Google AI Studio key required |
| Ollama | Any installed local model | Local and suitable for air-gapped deployments |
| Command | Description |
|---|
voidaccess investigate "QUERY" | Run an investigation |
voidaccess show | Open the interactive entity browser |
voidaccess export INVESTIGATION_ID --format FORMAT | Export as STIX, MISP, Sigma, YARA, Snort, Suricata, package, CSV, Markdown, or JSON |
voidaccess package INVESTIGATION_ID | Build an IOC package ZIP |
voidaccess enrich INVESTIGATION_ID | Re-enrich a saved investigation |
voidaccess list | List saved investigations |
voidaccess status | Show configuration, Tor, cache, engine, and seed status |
voidaccess actors | List persistent actor profiles |
voidaccess actor HANDLE | Show an actor profile |
voidaccess actor HANDLE --timeline | Show an actor activity timeline |
voidaccess actor HANDLE --note "TEXT" | Add an analyst note to an actor profile |
voidaccess timeline HANDLE | Open an actor timeline directly |
voidaccess configure | Run the setup wizard |
voidaccess configure llm | Configure the LLM provider, model, and key |
voidaccess configure keys | Configure enrichment API keys |
voidaccess configure tor | Override the Tor proxy host and port |
voidaccess version | Print the installed version |
| Self-hosting guide | Docker Compose, environment setup, operations, and troubleshooting |
| Architecture | Pipeline internals, modules, schema, API, enrichment, graph, and configuration reference |
| Contributing | Development setup, standards, and pull requests |
| Security | Supported versions and private vulnerability reporting |
| Usage policy | Authorized-use requirements and prohibited activity |
| PyPI | Published package and release files |
| GitHub | Source, issues, and releases |