--- title: VoidAccess: Self-Hosted Dark-Web Threat Research | daily.dev description: VoidAccess is an MIT-licensed, self-hosted platform for threat research across Tor-accessible sources and public security feeds. It extracts domains, IPs, file... canonical: https://daily.dev/posts/voidaccess-self-hosted-dark-web-threat-research-q7fcjmray twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: VoidAccess: Self-Hosted Dark-Web Threat Research | daily.dev og:description: VoidAccess is an MIT-licensed, self-hosted platform for threat research across Tor-accessible sources and public security feeds. It extracts domains, IPs, file... og:url: https://daily.dev/posts/voidaccess-self-hosted-dark-web-threat-research-q7fcjmray og:image: https://api.daily.dev/og/posts/q7FCjMrAy.png og:image:alt: VoidAccess: Self-Hosted Dark-Web Threat Research og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # VoidAccess: Self-Hosted Dark-Web Threat Research **[Noted](https://daily.dev/sources/noted)** · [@noted](https://daily.dev/noted) · 4 min read · 13 upvotes · 0 comments ## Summary VoidAccess is an MIT-licensed, self-hosted platform for threat research across Tor-accessible sources and public security feeds. It extracts domains, IPs, file hashes and threat references from a query and builds a relationship graph to show connections. Results export to STIX, MISP, CSV or Markdown. The Docker Compose stack runs PostgreSQL, Tor, a FastAPI backend and a Next.js frontend, plus a Python CLI option. It can use a local Ollama model for interpreting findings instead of a paid AI service, or run without an LLM entirely. The author recommends keeping it on a restricted network rather than exposing it publicly. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What services does the VoidAccess Docker Compose setup run? It runs four services: PostgreSQL for storing investigation data, Tor for reaching dark-web sources, a FastAPI backend, and a Next.js web interface. A separate Python command-line version is also available for terminal-based use. The setup wizard generates application secrets and database credentials during installation. _Evaluating self-hosted security tooling stacks is easier with daily.dev's coverage of real-world Docker deployments._ ### Can VoidAccess run AI analysis without sending data to a commercial AI provider? Yes, VoidAccess supports Ollama for running a language model locally, and it also offers a limited investigation mode with no LLM at all. External enrichment services requiring API keys are optional and get skipped when not configured, though searching Tor and public feeds still generates network traffic regardless of where the AI runs. _Developers weighing local versus cloud AI for sensitive workflows follow these trade-offs on daily.dev._ ### What export formats does VoidAccess support for threat intelligence findings? VoidAccess exports findings in STIX and MISP formats used by security teams, as well as simpler CSV and Markdown files. This lets researchers move collected domains, IP addresses, file hashes and threat relationships out of the tool and into existing security workflows after an investigation concludes. _Teams comparing threat-intel tooling options can track format support details on daily.dev._ ## Similar posts on daily.dev - [Show HN: VoidAccess – open-source dark web OSINT, from query to a graph](https://daily.dev/posts/show-hn-voidaccess-open-source-dark-web-osint-from-query-to-a-graph-pvawsibzw) · Hacker News · 0 upvotes · 0 comments - [Build your own vulnerability harness](https://daily.dev/posts/build-your-own-vulnerability-harness-qm0qjudbn) · Cloudflare · 4 upvotes · 0 comments - [I gave my local LLM my Docker Compose files, and it found security holes I missed](https://daily.dev/posts/i-gave-my-local-llm-my-docker-compose-files-and-it-found-security-holes-i-missed-bmcpmzzd5) · XDA Developers · 1 upvotes · 0 comments - [Self-Host Weekly \(17 April 2026\)](https://daily.dev/posts/self-host-weekly-17-april-2026--57suy7dgc) · selfh.st · 6 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#self-hosting](https://daily.dev/tags/self-hosting), [#docker-compose](https://daily.dev/tags/docker-compose) [View this post on daily.dev](https://daily.dev/posts/voidaccess-self-hosted-dark-web-threat-research-q7fcjmray) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"VoidAccess: Self-Hosted Dark-Web Threat Research","url":"https://daily.dev/posts/voidaccess-self-hosted-dark-web-threat-research-q7fcjmray","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/voidaccess-self-hosted-dark-web-threat-research-q7fcjmray"},"datePublished":"2026-10-25T17:28:59.822Z","dateModified":"2026-10-26T14:00:15.053Z","description":"VoidAccess is an MIT-licensed, self-hosted platform for threat research across Tor-accessible sources and public security feeds. It extracts domains, IPs, file...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f999ba1d057d43028a25d68e3ac1604d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f999ba1d057d43028a25d68e3ac1604d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Noted","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Person","name":"Jeremy","url":"https://daily.dev/noted","image":"https://media.daily.dev/image/upload/f_auto/v1650038055/avatars/Ep4ZyI0wF3cWNWXQjc2m1","description":"Hey there! 👋 I'm Jeremy, creator of Noted.lol. I'm a Self Hosting and Homelab autodidact!","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":4000}},"commentCount":0,"discussionUrl":"https://daily.dev/posts/voidaccess-self-hosted-dark-web-threat-research-q7fcjmray","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,self-hosting,docker-compose","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Noted","item":"https://daily.dev/sources/noted"},{"@type":"ListItem","position":3,"name":"VoidAccess: Self-Hosted Dark-Web Threat Research"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/voidaccess-self-hosted-dark-web-threat-research-q7fcjmray#faq","mainEntity":[{"@type":"Question","name":"What services does the VoidAccess Docker Compose setup run?","acceptedAnswer":{"@type":"Answer","text":"It runs four services: PostgreSQL for storing investigation data, Tor for reaching dark-web sources, a FastAPI backend, and a Next.js web interface. A separate Python command-line version is also available for terminal-based use. The setup wizard generates application secrets and database credentials during installation. Evaluating self-hosted security tooling stacks is easier with daily.dev's coverage of real-world Docker deployments."}},{"@type":"Question","name":"Can VoidAccess run AI analysis without sending data to a commercial AI provider?","acceptedAnswer":{"@type":"Answer","text":"Yes, VoidAccess supports Ollama for running a language model locally, and it also offers a limited investigation mode with no LLM at all. External enrichment services requiring API keys are optional and get skipped when not configured, though searching Tor and public feeds still generates network traffic regardless of where the AI runs. Developers weighing local versus cloud AI for sensitive workflows follow these trade-offs on daily.dev."}},{"@type":"Question","name":"What export formats does VoidAccess support for threat intelligence findings?","acceptedAnswer":{"@type":"Answer","text":"VoidAccess exports findings in STIX and MISP formats used by security teams, as well as simpler CSV and Markdown files. This lets researchers move collected domains, IP addresses, file hashes and threat relationships out of the tool and into existing security workflows after an investigation concludes. Teams comparing threat-intel tooling options can track format support details on daily.dev."}}]} ```