KatrielMoses/voidaccess

What it solves

VoidAccess simplifies the process of conducting Open Source Intelligence (OSINT) on the dark web. It automates the tedious work of searching Tor indexes, extracting technical indicators (like crypto wallets or malware hashes), and enriching that data with external threat feeds to turn raw queries into structured threat intelligence.

How it works

The tool uses a multi-stage pipeline to process investigations:

1. Collection: It searches Tor engines, paste sites, and code forges in parallel to gather data.
2. Processing: It filters noise, fetches pages via Tor, and uses a vector cache to avoid redundant processing.
3. Analysis: It extracts entities (IOCs, handles, CVEs) using regex, Named Entity Recognition (NER), and optional LLM analysis.
4. Synthesis: It maps relationships between actors and infrastructure, building co-occurrence graphs and clusters.
5. Export: The final intelligence is converted into industry-standard formats like STIX 2.1, MISP, or YARA rules.

Who it’s for

It is designed for security researchers, threat-intelligence teams, and authorized investigators who need a unified workflow for dark-web collection and relationship mapping.

Highlights

• Broad Collection: Accesses 16+ Tor search engines, curated .onion seeds, and open-web sources like GitHub and Pastebin.
• Deep Enrichment: Integrates with numerous feeds including AlienVault OTX, Shodan, VirusTotal, and blockchain explorers.
• Flexible LLM Integration: Supports various providers (OpenRouter, Groq, OpenAI, Anthropic, Google Gemini) and local deployment via Ollama.
• Structured Output: Exports data into multiple formats including STIX, MISP, Sigma, and JSON.
• Self-Hostable: Can be deployed as a local CLI tool or a full Docker Compose stack with PostgreSQL and a web UI.