VoidAccess Open-Source Dark Web OSINT Platform

Overview

VoidAccess is an open-source, self-hosted platform that automates the process of dark web Open-Source Intelligence (OSINT) gathering. It is designed to assist security researchers and threat intelligence teams by streamlining the workflow from an initial query to a structured relationship graph, providing a free alternative to commercial platforms like Recorded Future, DarkOwl, and Flare.

Core Functionality and Pipeline

VoidAccess operates through a 13-stage automated pipeline that handles everything from initial data collection to final intelligence export. The platform performs parallel collection across Tor search engines, paste sites, code forges, and curated RSS feeds. Once data is collected, the system performs entity extraction—identifying indicators of compromise (IOCs), cryptocurrency wallets, credentials, and actor handles—before enriching the findings with data from threat intelligence sources like AlienVault OTX, VirusTotal, and Shodan.

Key features include:

  • Relationship Mapping: Automatically builds co-occurrence graphs, community clusters, and infrastructure maps.
  • Structured Exports: Supports output formats including STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, and JSON.
  • Actor Intelligence: Maintains persistent profiles for threat actors, including timelines, aliases, and analyst notes.
  • Flexible Deployment: Runs as a CLI tool or a full Docker Compose stack with a web interface.

Technical Architecture

VoidAccess is built to be modular, allowing users to integrate various Large Language Models (LLMs) for query refinement and analysis. It supports providers such as OpenRouter, Groq, OpenAI, Anthropic, and Google Gemini, as well as local inference via Ollama for air-gapped environments.

For environments where NLP dependencies are unavailable, the system includes a deterministic SHA-256 fallback encoder, though users can install voidaccess[nlp] to enable full sentence-transformer vector embeddings. The platform is designed to handle API keys gracefully, skipping enrichment sources if keys are not provided.

Community Discussion

The release of VoidAccess on Hacker News generated interest regarding its utility for security research. While some users expressed skepticism regarding the provenance of the project's documentation and announcement style, others noted the technical potential of the tool's automated pipeline.

Regarding the project's utility, some users inquired about practical applications:

"Any interesting security reports you can share?" — @girishkvs

Others noted the ambitious scope of the project:

"I checked the repo. it seems pretty interesting ngl." — @varman11

Usage Policy

VoidAccess is licensed under the MIT license and is intended strictly for authorized security research and professional threat-intelligence work. Users are encouraged to review the project's USAGE_POLICY.md to ensure compliance with ethical and legal standards for intelligence gathering.

Sources