What is VoidAccess?
VoidAccess is an open-source dark web OSINT and threat intelligence platform maintained in the KatrielMoses/voidaccess repository on GitHub under the MIT license. The official website names Katriel Moses as its builder. The README describes the product as taking one question and returning a sourced report, a searchable relationship graph and indicators of compromise that can be loaded into other tools, and lists security researchers, threat intelligence teams, MSSPs and authorized investigators as its audience.
The project's Usage Policy describes VoidAccess as a passive OSINT platform that collects and analyzes publicly accessible information from dark web sources: it searches .onion domains via Tor, extracts content from accessible pages and uses large language models to write threat intelligence summaries. The policy states that it does not exploit systems, does not de-anonymize users, does not store scraped content at scale beyond individual investigations and does not provide real-time attack capabilities. The README closes its license section by stating that VoidAccess is to be used only for authorized security research and threat-intelligence work.
VoidAccess is distributed in two ways. The engine is published on PyPI as voidaccess for Python 3.10 or newer, and the self-hosting guide describes a four-service Docker Compose stack with PostgreSQL, a Tor proxy, a FastAPI backend and a Next.js web interface. The hosted service at voidaccess.pro runs the same engine on the operator's servers, sending searches and page fetches out through Tor, and the README notes that the hosted version uses a subset of sources whose terms allow it.
The latest GitHub release is VoidAccess 2.1.0, published on October 18, 2026, which the release notes call a security release for multi-user self-hosted installs. It fixes cross-user data exposure, adds user and admin roles, moves web sessions to httpOnly cookies, makes forwarded-IP trust opt-in and adds database migrations 0027 to 0036. The changelog also documents a 2.2.1 entry dated October 29, 2026 that fences scraped text before it reaches the language model to reduce prompt injection, detects defanged onion addresses in page text and reduces the Tor search fan-out to 7 engines after removing engines that were down or returned fixed results.
The backend is written in Python 3.11 with SQLAlchemy and PostgreSQL 16, optional Redis for token revocation and rate limits, and a Next.js 14 frontend; the CLI uses a local SQLite database under ~/.voidaccess/. The architecture reference lists known limitations, including that only 3 of the 16+ configured .onion search engines reliably returned results at the time of writing and that concurrent investigations share one Tor proxy. Other OSINT tools listed on iThub include SpiderFoot, theHarvester and sn0int.
VoidAccess screenshots
Explore the interface. Open a screenshot to view it at full size.
Investigation results as a searchable graph with values grouped by category. Frame from the official README demo.
Starting an investigation on the hosted service with Quick or Standard depth. Frame from the official README demo.
Live pipeline view with stage counts and discard reasons. Frame from the official README demo; the trail list at the bottom is blurred.
Official README graphic of the five pipeline steps.
Official README graphic of the nine export formats.
Source: official VoidAccess project page.
Key capabilities
- Question-to-report pipeline An investigation starts from a plain-language query that a language model refines, then moves through collection, filtering, fetching, entity extraction, enrichment, graph building and summarization. The web interface shows each stage live, including how many links were found, kept or discarded and why. The architecture reference documents phase timeouts, recovery and cancellation for each step.
- Stated data sources According to the README, collection draws on Tor search engines and curated .onion seed lists, paste sites, GitHub, GitLab and curated RSS feeds, and threat feeds such as AlienVault OTX, abuse.ch (MalwareBazaar, ThreatFox, URLhaus) and CISA KEV. Enrichment uses services including Shodan InternetDB, GreyNoise, AbuseIPDB, crt.sh, URLScan.io, the Wayback Machine, VirusTotal, Hybrid Analysis, Have I Been Pwned, BlockCypher and Etherscan. Sources that need an API key are skipped when no key is configured.
- Entity extraction The README lists the categories VoidAccess extracts: threat actor handles, ransomware groups, malware families and MITRE ATT&CK techniques; IP addresses, domains, URLs, .onion addresses and file hashes; cryptocurrency wallets for chains such as Bitcoin, Ethereum and Monero; messaging handles; CVEs and Exploit-DB IDs; and credentials. The README states that credentials such as cloud keys, tokens and stealer-log entries are masked.
- Relationship graph Extracted entities are linked into a relationship graph with detected communities and infrastructure clusters, and cross-referenced against earlier findings. The results view groups values by category with a search box, and the architecture reference describes node and edge construction, relationship inference and path finding between nodes.
- Nine export formats Investigations export as STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, JSON and Markdown, and the CLI can also build an IOC package ZIP. On the hosted service, the pricing page lists STIX, MISP, IOC packages and detection rules as Pro and Pro+ features, with Free runs showing a preview.
- Mandatory content safety filters The Usage Policy states that mandatory filters block queries, URLs and content related to child sexual abuse material, gore, snuff content and other illegal or harmful material, and that this filtering cannot be disabled. The architecture reference describes six layers: query intake, URL pre-scan, paste and RSS content, scraped content, post-extraction entity values and audit logging. Only an event type, user ID and hash prefix of a blocked item are logged, never the prohibited text.
- Command-line interface
pip install voidaccessinstalls a CLI with commands to configure the LLM provider, enrichment keys and Tor, run and list investigations, open an interactive entity browser, export and re-enrich saved results, and view actor profiles and timelines. A clearnet-only mode runs without Tor or a language model key. CLI data is stored in a local SQLite database and results folder under~/.voidaccess/. - Self-hosted Docker stack The repository's Docker Compose file runs PostgreSQL on port 5433, a Tor SOCKS5 proxy on 9050, the FastAPI backend on 8000 and the web UI on 3001. Guided setup scripts for macOS, Linux, WSL and native Windows create the
.envfile, generate secrets, configure the LLM provider and start the stack. The self-hosting guide lists the required settings and troubleshooting steps. - Multi-user accounts and API The self-hosted API uses JWT authentication with 8-hour tokens and optional Redis-based revocation, and version 2.1.0 added user and admin roles with ownership checks on investigations, entities, graphs, exports, actors and monitors. The REST API exposes an OpenAPI schema at
/docs. Per-user and global request limits default to 120 per minute. - Supported LLM providers The README lists OpenRouter as the default route, along with Groq, OpenAI, Anthropic (with Claude Haiku as the tested default), Google Gemini and Ollama for local models, which the README describes as suitable for air-gapped deployments. Optional sentence-transformer embeddings install with
voidaccess[nlp]; without them a deterministic fallback encoder is used. - Actor intelligence layer Persistent actor profiles collect aliases, notes and a timeline across investigations, with cross-alias resolution described in the architecture reference. The CLI exposes
voidaccess actorsandvoidaccess actor HANDLE, and version 2.1.0 made actor notes and aliases private to each user. - Monitors and alerts Keyword watches rerun an investigation on a schedule and alert on new entities, and URL watches fetch a specific page and alert on significant changes. Scheduling uses APScheduler, and alerts can be delivered through channels such as a Telegram bot. In 2.1.0, monitors moved from YAML files into the database with per-user ownership.
- Prompt-injection handling The 2.2.1 changelog entry describes fencing scraped page text, search results, URLs and page-derived entity values inside a data block with a random per-call boundary before they reach the model, and labelling pages that look like prompt-injection attempts as suspect. The LLM query rewrite keeps identifiers such as domains, hashes, CVEs and wallet addresses exactly, falling back to the original query otherwise.
- Hosted service and pricing The pricing page lists a Free plan with 100 credits a month, Pro at $9 a month (with a $7 founding price for the first 100 subscribers) with 2,000 credits, and Pro+ at $19 a month with 4,500 credits. A Quick investigation costs 20 credits and a Standard one 40, failed or cancelled runs are refunded, and top-ups from $5 to $500 are available. The site states that results never link to dark-web pages and show found addresses as text.
- Legal and ethical-use terms The Usage Policy lists permitted uses such as defensive research into threat actors and malware, collecting IOCs for detection, monitoring for mentions of one's own organization, academic research and authorized law enforcement work. It prohibits targeting, harassing, extorting or doxxing anyone, investigating for third parties without documented authorization, locating or accessing illegal content, bypassing the content filter and feeding results into offensive tooling. It places legal responsibility on the user and states that the maintainer is not responsible for how output is used.
- No-warranty statement The Usage Policy states that the tool is provided as-is with no guarantees of accuracy, completeness or fitness for purpose. It notes that dark web sources may be deliberately misleading, defunct or operated by threat actors, and that threat actors plant false information, so intelligence from the tool should be validated before it is acted on.
Where VoidAccess fits
Checking for mentions of an organization
The website describes searching a company's domain and brand across dark web search engines and GitHub to see what is being said about it. The Usage Policy lists monitoring dark web sources for mentions of one's own organization, assets, employees or data as a permitted use, and requires documented authorization before investigating organizations the user does not own or is not authorized to investigate.
Tracking a ransomware group
The website lists mapping a group's .onion sites, wallets, handles and exploited CVEs and showing how they connect as a use case. Results appear as a relationship graph with communities and infrastructure clusters, and actor profiles keep aliases, notes and a timeline across investigations, as described in the architecture reference.
Turning indicators into detection content
Starting from a handle, wallet or hash, an investigation produces IOCs that export as STIX 2.1 or MISP for sharing and as Sigma, YARA, Snort or Suricata rules for detection, plus CSV, JSON and Markdown. The README and website describe these exports as intended for loading into the analyst's existing SIEM and intelligence tools.
Reviewing earlier findings
The hosted service keeps findings from earlier investigations in a dated archive, which the website describes as a way to see infrastructure that has since gone offline. Its FAQ states that this archive never contains the user's identity or query text, and that investigations are deleted when the account is deleted. Self-hosted installs keep investigation data in their own PostgreSQL or SQLite database.
Running the engine on one's own infrastructure
Teams that run VoidAccess themselves install the CLI from PyPI or deploy the Docker Compose stack described in the self-hosting guide, choosing a hosted or local LLM provider and optional enrichment keys. The 2.1.0 security advisory documents the steps for multi-user installs, including database migrations and role recovery.
Academic and defensive research
The Usage Policy names threat intelligence analysts, SOC teams, penetration testers within authorized scope, law enforcement and government agencies, and academic researchers studying cybercrime and dark web ecosystems as its intended users. The hosted service's acceptable use policy adds journalists and requires every user to accept it before running an investigation.
Install
pip install voidaccessReviews of VoidAccess
Be the first to share your experience with VoidAccess.
Write a review
Loading review form…
Alternatives to VoidAccess
theHarvestertheHarvester gathers public intelligence about domains and organizations through a command line, local browser interface and REST API for authorized security assessments.Ssn0intsn0int is an open-source OSINT framework that gathers public information through sandboxed modules for reconnaissance and account research.