Dark-web OSINT · hosted · open source

Dark-web threat intel
in your browser.

Ask one question. VoidAccess searches 12+ Tor search engines, GitHub and security feeds in parallel, then gives you back actors, wallets, leaked credentials and IOCs, ready to export as STIX, MISP or Sigma. No Tor to run. Nothing to install.

Start freeHow it works

100 free credits a month · no card · from $7/mo after that

Open source (MIT)896★ on GitHub18k+ downloadsBuilt by Katriel Moses, who found CVE-2026-50112 (Apache CloudStack RCE)

01 Use cases

What people use it for

01

Is your company on a leak site?

Search your domain and brand across dark-web search engines and GitHub. See what's being said before an attacker acts on it.

02

Track a ransomware group

Map a group's .onion sites, wallets, handles and the CVEs it exploits, and see how they connect.

03

Turn a lead into detections

Start from a handle, a wallet or a hash. End with IOCs and Sigma, YARA or Suricata rules your SIEM can load.

04

See what was there before

Findings from earlier investigations stay in the VoidAccess archive, dated, so you can still see infrastructure that has since gone offline.

For security researchers, threat-intel teams, MSSPs and authorised investigators.

02 Sources

12+ Tor search engines and public threat intel, searched at once.

One query fans out from our servers through Tor and follows new .onion links as it finds them. You never touch Tor yourself.

CH 1relayed

Tor search engines

Torch, Ahmia, Tor66 and 9+ more.

CH 2bursty

Threat intel

Indicators checked against public threat-intel sources.

CH 3structured

GitHub

Leaked keys, tooling, configs.

CH 4periodic

Security feeds

Headlines and snippets from research feeds.

CH 5recursive

Curated .onion seeds

Known starting points, followed recursively.

Checked against public sources including CISA KEV, NVD, MITRE ATT&CK, crt.sh, RDAP and the Wayback Machine.

03 How it works

From question to report in one run.

  1. 01

    Ask

    Type a question in plain English. The AI sharpens it before anything is collected.

  2. 02

    Collect

    Dark-web search engines, GitHub and security feeds are searched in parallel through Tor.

  3. 03

    Filter

    Noise, duplicates and prohibited content are dropped automatically.

  4. 04

    Extract

    Actors, wallets, credentials, CVEs and IOCs are pulled out and cross-checked.

  5. 05

    Deliver

    You get a summary, a searchable relationship graph and an export-ready result.

04 Entities

It pulls out what analysts actually need.

Pattern matching, entity recognition and optional AI analysis, cross-referenced against earlier findings. Values below are defanged samples.

01actorThreat actors and ransomware groupsLockBitSupp
02malwareMalware familiesLockBit 3.0
03cveCVEs and ATT&CK techniquesCVE-2023-4966
04walletCrypto walletsBTC, ETH, XMR and 8 more chainsbc1q…k7x2
05handleHandlesTelegram, Discord, XMPP, Tox, Session, Matrix@ransom_ops
06credentialLeaked credentials, always maskedcloud keys, tokens, stealer logs, combo listssvc_backup:••••••
07iocInfrastructureIPs, domains, .onion, hasheslockbit…[.]onion
05 Product

This is what you get back.

A VoidAccess investigation's results: a relationship graph of actors, malware, CVEs and onion links, with a sidebar listing extracted values by type and a toolbar for zoom, layout and table view.
A summary you can send, a graph you can search, and IOCs you can load. Viewing results and exporting cost nothing.
06 Exports

Nine formats for the tools you already run.

STIX 2.1 and MISP for sharing. Sigma, YARA, Snort and Suricata for detection. CSV, JSON and Markdown for everything else. CSV and JSON are on every plan, including Free.

STIX 2.1sharing
MISPevents
Sigmadetection
YARApatterns
Snortnetwork
Suricatanetwork
CSVtables
Markdownreports
JSONraw
07 Compare

Enterprise threat-intel output without the enterprise price.

Enterprise dark-web intel platforms compared with VoidAccess
Enterprise dark-web intel platformsVoidAccess
PriceFrom ~$40k a year, sales call firstFree, then from $7/mo
SetupProcurement and onboardingSign in and search
STIX / MISP exportYesYes
Open sourceNoYes, MIT. Self-host free forever

They have closed-forum access, analyst teams and years of archives. We don't. VoidAccess is for researchers and small teams who need answers today, not a contract.

08 Open source

Open source at the core.

The engine is MIT-licensed on GitHub with 896★. Run it yourself for free, or skip setting up Tor, Docker and API keys from $7 a month.

View on GitHub
09 Questions

Questions security teams ask first

Is this legal?

VoidAccess searches publicly reachable sources: Tor search engines, code hosts and public threat feeds. It doesn't log into closed forums or buy data. Every account agrees to our Acceptable Use Policy, which limits use to security research and authorised investigation.

Will it show me illegal content?

Safety filters block prohibited queries, links and page content before anything reaches you, and results never link to dark-web pages. Found addresses are shown as text you can copy, not links.

What happens to my queries?

Your investigations are kept while your account is open and deleted when you delete it. Queries and collected text go to our AI providers to refine the search and write the summary, never with your account details. Findings go into an anonymous, dated archive that never contains your identity or your query text. Read the privacy policy.

Who is it not for?

Stalking, doxxing, harassment, or anyone looking for illegal content or services. We close accounts that try.

Can I self-host instead?

Yes. pip install voidaccess, MIT licence, free forever.

What will you hunt today?

Hosted, nothing to install. 100 free credits every month, about 5 Quick or 2 Standard investigations. No card.

Already have an account? Sign inPrefer to self-host?