Show HN: VoidAccess – open-source dark web OSINT, from query to a graph

VoidAccess is a self-hosted OSINT platform that converts dark-web and open-web research queries into structured threat intelligence and relationship graphs. Built for security researchers, threat-intel teams, and authorized investigators, it automates collection, enrichment, entity extraction, actor profiling, and export in a single workflow. It runs locally as a simple CLI or as a Docker Compose stack (SQLite for quick runs or PostgreSQL for production) with an optional browser UI. Core capabilities include parallel collection from Tor indexes, paste sites, code forges, RSS feeds and curated .onion seeds; extraction of IOCs, wallets, credentials, handles, vulnerabilities, malware and people; persistent actor profiles and timelines; and relationship graphs that reveal co-occurrence, communities and infrastructure clusters. Outputs include STIX 2.1, MISP, Sigma, YARA, Snort/Suricata, CSV, JSON and packaged IOC archives.

The pipeline is documented as 13 staged steps from LLM query refinement through recursive .onion discovery, Tor fetches, enrichment, entity extraction (regex, NER, optional LLM), historical cross-referencing and graph building to final export. Enrichment pulls from many sources (AlienVault OTX, abuse.ch, MalwareBazaar, URLhaus, Shodan, GreyNoise, VirusTotal, Have I Been Pwned, BlockCypher, Etherscan, etc.), and supports optional vector embeddings with a deterministic SHA-256 fallback when NLP stacks are absent. Multiple LLM providers are supported (OpenRouter, Groq, OpenAI, Anthropic, Google Gemini, Ollama). Mandatory pipeline gates enforce content-safety and authorized-use policy. The code is MIT-licensed and documented with architecture, self-hosting and configuration guides.