VoidAccess: A Self-Hosted Pipeline for Dark Web OSINT, Reviewed
Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
At a glance
- What is it?
- VoidAccess is an MIT-licensed Python tool that runs a 13-stage collection and enrichment pipeline against Tor indexes, paste sites and threat feeds, then exports STIX, MISP, YARA and other formats. The design is honest about its dependencies: without API keys and Tor, it degrades to a much thinner tool.
- Who is it for?
- Adopt VoidAccess if you want a self-hosted collection and export pipeline you can read and modify, and if you are prepared to supply Tor plus a stack of enrichment API keys. Do not adopt it if you need a managed feed with contractual coverage or if your team cannot operate a Tor proxy and a Postgres stack.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 43 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The gap VoidAccess targets: collection to graph without a vendor contract
Commercial threat intelligence platforms such as Recorded Future, DarkOwl and Flare sell a finished feed. You query a console, you get results, and someone else runs the crawlers, the Tor exit capacity and the enrichment contracts. VoidAccess takes the opposite position. It is a Python package you install and run yourself, and the README frames it as a free alternative to those three products. The audience named in the README is specific: security researchers, threat-intelligence teams and authorized investigators. That framing matters because the tool assumes the operator is allowed to be doing the collection. A pipeline that searches Tor indexes, paste sites and code forges on your behalf puts the legal and ethical question of authorized research on your desk, not a vendor's. The README also lists mandatory content-safety gates that filter prohibited queries, URLs, content and extracted entities during the pipeline. Those gates are a design acknowledgement that the same collection capability can be pointed at material you should not be handling.
The 13 stages and what each one actually moves
The README publishes the pipeline as a numbered table, which is unusual and useful. Stage 1 refines the query with the selected LLM. Stage 2 collects in parallel from Tor search, paste sites, code forges, RSS feeds and curated seeds. Stage 3 filters noisy pages. Stage 4 enriches the query and early indicators from threat-intelligence sources. Stage 5 discovers additional .onion links recursively, which is where the crawl can expand well beyond what you asked for. Stage 6 reuses recently processed pages from a vector cache. Stage 7 fetches selected pages through Tor with response-size limits. Stage 8 persists new content. Stage 9 merges collected and enriched intelligence. Stage 10 extracts entities using regex, NER and optional LLM analysis. Stage 11 cross-references entities against historical and seed datasets. Stage 12 builds relationships, communities and infrastructure clusters. Stage 13 produces the summary and the export-ready result. The data flow is therefore collect, filter, enrich, fetch, persist, merge, extract, cross-reference, graph, summarise. Two stages deserve attention. Stage 6 is a cache, so repeated investigations over the same material should cost less, though the README does not state the eviction policy. Stage 10 stacks three extraction methods, and the LLM leg is optional, which means the quality of extraction depends on which legs you have enabled. The README points to docs/architecture.md for timeouts, recovery and full data flow, and that document is where you would have to look before trusting the pipeline under load.
Installation, the first run, and the flags that matter
The README gives a short quick start. Install with pip install voidaccess, then run voidaccess investigate "LockBit ransomware" --no-llm --no-tor --depth shallow. Those three flags are the interesting part. --no-llm skips the LLM refinement and analysis stages, --no-tor avoids the Tor fetch path, and --depth shallow limits how far the investigation goes. The combination is a smoke test that exercises the pipeline without external dependencies. Supporting commands are voidaccess list, voidaccess actors and voidaccess status. status is the one to run first on a new machine, because the README says it shows configuration, Tor, cache, engine and seed status. Configuration is handled by voidaccess configure, with subcommands configure llm, configure keys and configure tor to set the LLM provider, the enrichment API keys and the Tor proxy host and port. The README states that sources needing API keys skip cleanly when their keys are absent, so a partial key set produces a smaller result rather than a crash. For a fuller install, pip install "voidaccess[nlp]" adds the sentence-transformer embedding stack. Without it, the README says the tool logs that it is using a deterministic SHA-256 fallback encoder. That fallback is a real behavioural difference: SHA-256 hashing is not semantic similarity, so the vector cache and any embedding-based matching will behave differently from the documented default.
Deployment shapes: SQLite on a laptop, Postgres in Compose
The README describes two deployment modes. The CLI runs locally with SQLite, which is the low-friction path for a single analyst. The Docker Compose stack adds PostgreSQL and a browser interface. Those are genuinely different operating profiles. SQLite means no service to keep running, and it means the database is a file you can copy. PostgreSQL plus a web UI means a shared instance that more than one person can reach, and it means you now own a database to back up and a web surface to secure. The README does not describe authentication for the web interface, so that is something to verify in docs/architecture.md before exposing it beyond localhost. The repository ships a docker-compose.yml at the project root, referenced by a badge, so the Compose path is a first-class part of the layout rather than an afterthought.
Enrichment breadth is the selling point, and the dependency surface is the cost
The collection and enrichment tables are long. Dark web search covers 16 or more Tor search engines plus curated .onion seeds. Open web collection covers Pastebin, dpaste, paste.ee, Rentry, GitHub, GitLab and curated RSS feeds. Threat feeds include AlienVault OTX, abuse.ch, MalwareBazaar, ThreatFox, URLhaus, ransomware.live and CISA KEV. IP and domain context draws on Shodan InternetDB, GreyNoise, AbuseIPDB, Feodo Tracker, C2IntelFeeds, crt.sh, URLScan.io, the Wayback Machine, CIRCL PDNS and RDAP. File and identity context adds VirusTotal, Hybrid Analysis, Have I Been Pwned and EmailRep. Blockchain lookups go through BlockCypher and Etherscan. Optional clearnet requests can use ScrapingAnt. Read that list as a dependency inventory rather than a feature list. Every keyed service has its own rate limit, its own terms of use and its own retention rules, and several of them are commercial APIs with paid tiers once you exceed a free quota. The README's claim that missing keys skip cleanly is a sensible design, but it also means two operators running the same query can get different results depending on which keys they hold. Reproducibility across installations is therefore not something this tool can promise.
Exports, actors and the graph as the durable artifact
The export surface is wide: STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, Markdown, JSON and an IOC package ZIP, reachable through voidaccess export INVESTIGATION_ID --format FORMAT and voidaccess package INVESTIGATION_ID. That matters because it means VoidAccess does not have to be the system of record. You can collect here and push into whatever MISP instance or detection pipeline you already run. The actor layer is the other durable piece. voidaccess actors lists persistent profiles, voidaccess actor HANDLE shows one, --timeline shows activity over time, and --note "TEXT" attaches an analyst note. The README says actor profiles persist aliases, infrastructure, notes, timelines and cross-investigation relationships. That last item is the real design decision: relationships survive across investigations, so the graph accumulates rather than resetting per query. Stage 12 builds co-occurrence graphs, communities, paths and infrastructure clusters, and stage 11 cross-references against historical and seed datasets. The value of the tool therefore grows with the number of investigations you have run, which also means the first few runs look thin.
Where VoidAccess is the wrong tool, and what to use instead
The clearest limitation is operational. This is a self-hosted system that depends on Tor for its dark web collection, on an LLM provider for query refinement and optional extraction, and on a long list of third-party APIs for enrichment. If your organisation blocks Tor egress, the dark web half of the pipeline is unavailable and you are left with an open-web collector. If you cannot send queries to a hosted LLM, you need Ollama or the --no-llm path, and the README notes Ollama as the local option suitable for air-gapped deployments. If you have no enrichment keys, you get collection and entity extraction without the reputation, breach, passive DNS and blockchain context that the README presents as a core capability. There is also a scope limit worth stating plainly: the README does not claim to monitor closed criminal forums or private marketplaces, and it does not describe any access to material behind registration or payment. Collection is limited to what Tor search engines, paste sites, code forges, RSS feeds and curated seeds expose. For a team that needs contractual coverage, an SLA or a managed feed with analyst support, a commercial platform remains the right answer, and VoidAccess is not trying to be that. For a team that wants a readable, modifiable pipeline it can extend with its own sources, the comparison is different. Tools like Aleph (OCCRP) and OpenCTI occupy adjacent ground. Aleph is built around document ingestion, search and cross-referencing over large corpora, with an emphasis on investigative journalism workflows. OpenCTI is a knowledge base for structured threat intelligence with connectors that pull from external feeds into a typed graph. VoidAccess differs from both in that the collection pipeline itself is the product: it goes out to Tor indexes and paste sites as part of the run rather than ingesting what you or a connector already have. If your problem is organising intelligence you already possess, OpenCTI is a better fit. If your problem is going and getting it, VoidAccess is aimed at you.
Maintenance, licence and version cadence
The licence is MIT, which permits commercial use, modification and redistribution provided the copyright notice and permission notice are retained. That is a permissive arrangement, and it removes the licence as an adoption blocker for most internal deployments. It is not legal advice, and if you plan to redistribute a modified VoidAccess or embed it in a product, have counsel read the LICENSE file rather than this paragraph. The version history shows a fast patch cadence: v2.0.1 addressed packaging and parity fixes, v2.0.2 addressed export reliability, and v2.0.3 addressed permission hardening and legacy data backfill, all within three days in August 2026. A cadence that tight suggests active maintenance, and it also suggests the 2.0 line was still settling when those releases shipped. Export reliability and permission hardening are exactly the kinds of fixes that matter in production, so running an older 2.0.x build carries known issues in both areas. The upgrade cost is mostly yours: because enrichment depends on external APIs and because actor relationships persist across investigations, a version bump can change extraction output or touch stored data, and v2.0.3's legacy data backfill is a reminder that schema changes do happen. Pin a version, read the release notes before moving, and keep a copy of the SQLite file or a Postgres dump before upgrading.
Editorial conclusion
Adopt VoidAccess if you want a self-hosted collection and export pipeline you can read and modify, and if you are prepared to supply Tor plus a stack of enrichment API keys. Do not adopt it if you need a managed feed with contractual coverage or if your team cannot operate a Tor proxy and a Postgres stack. Before committing, run 'voidaccess status' against your own configuration to see which engines, seeds and keyed sources actually resolve, and check docs/architecture.md for the timeout and recovery behaviour of the 13 stages.
Community notes