Dark-web research usually means a pile of disconnected steps: query a few Tor search engines, open results in a hardened browser, copy indicators into a spreadsheet, enrich them in five other tabs, then try to remember which handle showed up next to which wallet. Commercial platforms collapse that into one product, but the price and the closed collection logic put them out of reach for many small teams and individual researchers.

VoidAccess is a self-hosted, open source attempt at the same workflow. Its README describes a 13-step pipeline from a research query to an entity graph and export-ready intelligence. This article walks through what the repository documents, what the design choices imply, and where you should be skeptical before pointing it at an investigation.

One caveat on scope: this is a read of the project's README and file layout, not a benchmark. Where the documentation is silent, such as collection volume, accuracy or the license terms, this article says so rather than guessing.

The 13-stage pipeline

The README lays the pipeline out as numbered stages, and the ordering is the interesting part. In summary:

Refine the query with the selected LLM.
Collect in parallel from Tor search, paste sites, code forges, RSS feeds and curated seeds.
Filter noisy or irrelevant pages.
Enrich the query and early indicators from threat-intelligence sources.
Discover additional .onion links recursively.
Reuse recently processed pages from a vector cache.
Fetch selected pages through Tor with response-size limits.
Persist newly collected content.
Merge collected and enriched intelligence.
Extract entities with regex, NER and optional LLM analysis.
Cross-reference entities against historical and seed datasets.
Build relationships, communities and infrastructure clusters.
Generate the final summary and export-ready result.

Filtering happens before fetching, so irrelevant pages are dropped before they cost a Tor round trip. The vector cache sits in front of the fetch stage, so recently processed pages are reused instead of re-downloaded. Fetching also carries explicit response-size limits, which matters when you are pulling arbitrary content from hostile hosts. The README defers timeouts, recovery and data flow to a separate Architecture document.

Installing and running a first investigation

The quick start is short:

pip install voidaccess
voidaccess investigate 'LockBit ransomware' --no-llm --no-tor --depth shallow
voidaccess list
voidaccess actors
voidaccess status

The flags are worth noticing. --no-llm and --no-tor let you exercise the pipeline without a model provider or a Tor connection, so you can see the structure of the output before wiring in credentials. --depth shallow limits how far the run goes. A dry first run like this is a sensible way to check what lands in the database before you commit to a deeper, Tor-routed run.

Beyond the commands above, the README lists voidaccess show (an interactive entity browser), voidaccess export INVESTIGATION_ID --format FORMAT, voidaccess package INVESTIGATION_ID for an IOC ZIP, and voidaccess enrich INVESTIGATION_ID for re-enrichment. The extract of the CLI reference cuts off there, so check the repository for the full list.

Where the data comes from

The collection layer mixes dark-web and open-web sources, which is a deliberate choice: much of what is useful about a ransomware group is published on paste sites, code forges and threat feeds rather than behind an .onion address.

Layer	Sources named in the README
Dark-web search	16+ Tor search engines and curated .onion seeds
Open-web collection	Pastebin, dpaste, paste.ee, Rentry, GitHub, GitLab, curated RSS feeds
Threat feeds	AlienVault OTX, abuse.ch, MalwareBazaar, ThreatFox, URLhaus, ransomware.live, CISA KEV
IP and domain context	Shodan InternetDB, GreyNoise, AbuseIPDB, Feodo Tracker, C2IntelFeeds, crt.sh, URLScan.io, Wayback Machine, CIRCL PDNS, RDAP
File and identity context	VirusTotal, Hybrid Analysis, Have I Been Pwned, EmailRep
Blockchain	BlockCypher, Etherscan

Sources that need API keys skip cleanly when the key is absent. That is a good default for a tool that talks to this many services: a missing VirusTotal key degrades the enrichment rather than aborting the run. The flip side is that a run without keys is quietly thinner, so check which sources actually contributed before treating an empty enrichment as a negative result.

Entity extraction

Stage 10 combines regex, NER and optional LLM analysis. Regex is the right tool for rigidly formatted indicators such as hashes, IPs, CVE identifiers and wallet addresses. NER covers people, organizations and locations, and the LLM pass is optional, which keeps the base pipeline deterministic.

The entity catalogue is broad:

Cryptocurrency: Bitcoin, Ethereum, Monero, Litecoin, Zcash, Solana, Tron, ENS.
Network indicators: IPv4, IPv6, domains, URLs, .onion addresses, MAC addresses, PGP keys.
File indicators: MD5, SHA-1, SHA-256, malware families.
Credentials: cloud keys, tokens, JWTs, API keys, stealer logs, combo-list entries.
Messaging: Telegram, Discord, XMPP, Tox, Session, Matrix, Wire, ICQ, Wickr.
Vulnerabilities: CVEs, MITRE ATT&CK techniques and tactics, Exploit-DB IDs.

The README does not publish precision or recall figures for any of this. Regex-matched indicators in scraped dark-web text will include false positives, such as a 32-character hex string that is not an MD5, so treat extraction output as leads to verify rather than findings.

Relationship graphs and actor persistence

Stage 12 builds co-occurrence graphs, communities, paths and infrastructure clusters. Co-occurrence is a modest but useful signal: two entities appearing on the same page are candidates for a relationship, not proof of one. Communities and clusters help you see which wallets, handles and hosts group together across pages.

The more durable feature is actor intelligence. The README says VoidAccess persists aliases, infrastructure, notes, timelines and cross-investigation relationships, and exposes them through voidaccess actors. That turns individual runs into an accumulating knowledge base: a handle seen in one investigation can be cross-referenced against historical and seed datasets in stage 11 of the next. It also means the database becomes sensitive and worth backing up and access-controlling.

Exports and deployment modes

Output formats are where the project aims at existing security tooling: STIX 2.1, MISP, Sigma, YARA, Snort, Suricata, CSV, Markdown, JSON and IOC packages. STIX and MISP feed threat-intelligence platforms; Sigma, YARA, Snort and Suricata target detection engineering. Whether the generated rules are production-quality is not something the README claims, so review them before loading them into a sensor.

Deployment comes in two shapes. The CLI runs locally with SQLite. For teams, a Docker Compose stack adds PostgreSQL and a browser interface; the repository ships a docker-compose.yml, an alembic.ini for migrations, a .env.example and a monitors.yaml.example for scheduled monitoring. A SECURITY.md and CONTRIBUTING.md are present, which is a good sign for an open source project handling sensitive data.

Content safety and model choices

The README says content safety is enforced at mandatory pipeline gates that filter prohibited queries, URLs, content and extracted entities. For a tool that crawls dark-web markets and forums, that is a design requirement rather than a nicety. The README does not spell out here what counts as prohibited, so read the Architecture document and the sanitizer and trust_gate code before relying on it for compliance.

On the model side, supported providers are OpenRouter (the default route, with free models available), Groq, OpenAI, Anthropic, Google Gemini and Ollama. Claude Haiku is called the tested default. Ollama is the one to look at if your investigations cannot leave your network, since it runs local models and suits air-gapped deployments.

The vector layer is optional too. Without PyTorch, VoidAccess logs that it is using a deterministic SHA-256 fallback encoder; pip install 'voidaccess[nlp]' enables sentence-transformer embeddings. A hash-based encoder cannot capture semantic similarity, so expect the page-reuse cache to behave differently, and probably less usefully, in the default install.

Where this approach does not fit

The project positions itself as a free alternative to Recorded Future, DarkOwl and Flare. That is the repository's own framing, and a self-hosted collector is not the same thing as a commercial dataset. Those vendors sell, among other things, maintained collection infrastructure; a tool you run from your own machine collects only what your Tor circuits and search engines can reach during a run. The README gives no coverage or freshness numbers, so do not assume parity.

Other limits to plan around:

Operational risk is yours. Fetching hostile content through Tor from your own infrastructure needs network isolation and a legal review. The tool states it is for security researchers, threat-intelligence teams and authorized investigators.
Self-hosting is a maintenance job. Sixteen-plus search engines, scrapers and a dozen enrichment APIs break when upstream sites change, and you inherit that.
Extraction and graphs are probabilistic. Regex, NER, LLM output and co-occurrence all produce candidates. Anything going into a report or an attribution claim needs manual verification.
Check the license. A LICENSE file exists in the repository, but its terms are not in the material reviewed here. Confirm them before building anything commercial on top.

If you want a low-cost way to evaluate it, run the no-LLM, no-Tor shallow investigation first, inspect what the database and exports look like, and only then add keys, a model provider and Tor.

R and Python Package in One GitHub Repo or Two?

Comments

Related Articles

Oracle EXISTS AND NOT EXISTS Returns a Row: Bug 35915968

Advanced Programming in Low-Resource Languages

VoidAccess: open source dark web OSINT pipeline reviewed