VoidAccess Launches: Open-Source Dark Web OSINT Tool

Self-hostable OSINT for turning dark-web research queries into structured threat intelligence. Built for security researchers, threat-intelligence teams, and authorized investigators who need collection, enrichment, relationship mapping, and export in one workflow.

Terminal Output

Quick Start

pip install voidaccess
voidaccess investigate "LockBit ransomware" --no-llm --no-tor --depth shallow
voidaccess list
voidaccess actors
voidaccess status

What It Does

• Parallel collection - searches Tor indexes, paste sites, code forges, security feeds, and curated .onion seeds.
• Entity extraction - finds IOCs, wallets, credentials, handles, vulnerabilities, actors, malware, people, and organizations.
• Multi-source enrichment - adds reputation, breach, passive DNS, sandbox, blockchain, and threat-feed context.
• Actor intelligence - persists aliases, infrastructure, notes, timelines, and cross-investigation relationships.
• Relationship graphs - builds co-occurrence graphs, communities, paths, and infrastructure clusters.
• Content safety - filters prohibited queries, URLs, content, and extracted entities at mandatory pipeline gates.
• Structured exports - produces STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, Markdown, JSON, and IOC packages.
• CLI and web UI - runs locally with SQLite or as a Docker Compose stack with PostgreSQL and a browser interface.

Pipeline

Full pipeline behavior, timeouts, recovery, and data flow are documented in Architecture.

Entity Types

Collection and Enrichment

Sources that need API keys skip cleanly when their keys are absent. The complete key and configuration reference is in Architecture.

Optional vector embeddings

The default installation can run without PyTorch. When the embedding stack is unavailable, VoidAccess logs that it is using a deterministic SHA-256 fallback encoder. Install the optional NLP dependencies to enable full sentence-transformer vector embeddings:

pip install "voidaccess[nlp]"

LLM Providers

CLI Reference

Optional clearnet requests can use ScrapingAnt with --use-scraping-api or --use-proxies; Tor, .onion, GitHub, and GitLab traffic are unaffected.

（注：更多技术实现细节与完整 API 文档请查阅原项目 README）

作者发帖说明（HN）：

Hi HN! Im Katriel, and im a Security Researcher/Enthusiast and in the wave of AI, i wanted to build that next gen of security tooling that surpasses the current tools, and even the paid industries with an open source engine. I built MailAccess as well, which is going to be the best damn email osint tool out there, in another year. But just before building MailAccess i built VoidAccess, because i was delving a lot into DarkINT and the content inside the dark web is too difficult to navigate through for a human, so i automated that pipeline, made sure the noise was removed, and anything NSFW was filtered out, to give the analyst an overview of what is present in the dark web, without having to actually go through it manually.

Very simple to run, you just run a few commands to install, and a couple to investigate. Then the engine takes over, and stops onyl when the job is done(or at a particular time limit, if set by the user).

Do check it out, if that is something that interests you.

Thanks to the community for giving it the love it has got till now.