# DechoNet

> Security reconnaissance for people and AI agents. DechoNet observes domains from the outside and explains what it sees: is this text-message link a phishing site, what does a domain expose, did its certificate, DNS or headers change — and, for crypto, is this wallet address on a sanctions list and is this site the exchange it claims to be. The public tools need no sign-up and no API key; daily monitoring of your own domains needs a free account. English at https://dechonet.com, Korean at https://dechonet.com/ko.

Principles: observable signals only (no intrusion), every verdict comes with its reasons, nothing is called "safe" — the best result is "no warning signs found". Pasted messages are not stored. Measured accuracy and limits: https://dechonet.com/methodology

## Tools

- [Phishing / smishing link check](https://dechonet.com/util/phishing): paste a suspicious text message or URL; follows short links, checks domain age, Korean brand impersonation, APK downloads and phishing feeds. Korean: [스미싱·피싱 문자 링크 검사](https://dechonet.com/ko/util/phishing)
- [Exposed admin page check](https://dechonet.com/util/exposure): admin screens, test servers and dev tools open to the internet — subdomains from Certificate Transparency, each host opened once from outside — exposed admin logins, staging servers, developer tools, default pages, directory listings. Counts for anyone; per-host detail after DNS TXT ownership verification. Korean: [관리자 페이지 노출 점검](https://dechonet.com/ko/util/exposure)
- [Full domain audit](https://dechonet.com/util/all): one 0-100 score and A+ to F grade from SSL/TLS, HTTP headers, email authentication, registration (RDAP), DNS, exposed admin pages and reputation; DNS propagation, reverse DNS, ASN and open ports are shown for reference outside the score. Printable report link
- [Brand impersonation exposure](https://dechonet.com/util/impersonation): lookalike domains, risky subdomains and certificate transparency for a brand
- [Post-quantum TLS readiness](https://dechonet.com/util/pqc): hybrid X25519MLKEM768 key exchange, origin vs CDN
- [SSL/TLS certificate](https://dechonet.com/util/ssl), [HTTP security headers](https://dechonet.com/util/http), [Email authentication](https://dechonet.com/util/email), [DNS lookup](https://dechonet.com/util/dns), [DNS propagation](https://dechonet.com/util/propagation), [RDAP / WHOIS](https://dechonet.com/util/rdap), [Subdomains](https://dechonet.com/util/subdomains), [Lookalike domains](https://dechonet.com/util/lookalike), [OWASP observable checks](https://dechonet.com/util/owasp), [Go-live readiness](https://dechonet.com/util/golive), [Port check](https://dechonet.com/util/port) (service greetings, weak SSH algorithms), [ASN / BGP](https://dechonet.com/util/asn) (RPKI; for an IP, Tor exit / VPN / datacenter range), [Reverse DNS](https://dechonet.com/util/reverse-dns), [Email header analysis](https://dechonet.com/util/email-header), [MCP server check](https://dechonet.com/util/mcp-check) (a remote MCP server checked from outside before you connect it; no tool is called)

## Crypto checks

- [Crypto scam check](https://dechonet.com/crypto): paste a message, wallet address or link; the wallet addresses in it are found in your browser and each goes to the address check. Korean: [가상자산 사기 확인](https://dechonet.com/ko/crypto)
- [Wallet address check](https://dechonet.com/crypto/address): chain from the format (EVM, TRON, Bitcoin, Solana), checksum (EIP-55, Base58Check, bech32), the US Treasury OFAC SDN sanctions list (read daily) and how many pages DechoNet judged dangerous showed the address. Listed means on that day's list; not listed does not mean clean. The address is not stored
- [Official exchange address check](https://dechonet.com/crypto/exchange): is a site the official address of a Korean exchange (Upbit, Bithumb, Coinone, GOPAX, DigitalX/Korbit) or a major global exchange, wallet or dApp — compared only with addresses the companies publish themselves; a domain using a name gets its age, first certificate and a phishing check of its front page
- [Exchange impersonation domains](https://dechonet.com/crypto/watch): how many new domains carrying each exchange, wallet or dApp name appeared in certificate transparency logs, and how many DechoNet judged dangerous — counts only
- [For AI agents with wallets](https://dechonet.com/crypto/agents): `crypto_check_before_sign` judges the destination address, the page that asked and the wallet request (unlimited approvals, Permit signatures, setApprovalForAll) before signing or sending
- DechoNet never holds or moves assets, gives no investment opinion and never asks for a seed phrase or private key

## Monitoring and plans

- [Security monitoring](https://dechonet.com/monitoring): sign up with an email address, prove domain ownership with a DNS TXT record, and DechoNet checks the certificate, DNS, security headers, registration and exposed admin pages every day and emails you what changed. One domain is free.
- [Plans and pricing](https://dechonet.com/pro): Starter, Business and Agency add new-certificate alerts, page tampering, brand impersonation alerts, exploited-vulnerability (CISA KEV) alerts, executive reports, DMARC report intake, client grouping, staff seats, white-label reports and bulk checks.
- [Deploy gate for CI](https://dechonet.com/util/golive): fail a deployment when HTTPS, certificate grade, days to expiry or security-header grade fall below your threshold — GitHub Action `node-man/dechonet-gate@v1` or a plain API call.

## For AI agents (MCP)

- Remote endpoint (Streamable HTTP, no install, no key needed): https://dechonet.com/mcp — 33 tools (`infrastructure_pivot` needs an API key) including `phishing_link_check`, `wallet_address_check`, `crypto_exchange_check`, `crypto_check_before_sign`, `check_before_action` (warning signs on a page before an agent signs in or pays there), `security_scan`, `exposure_map`, `mcp_server_check`, `set_expectations` / `verify_expectations`, `domain_changes`, `domain_history`, `infrastructure_pivot` and `watch_domain`
- Signed observation receipts: results of domain, host and IP tools can carry an Ed25519-signed receipt anyone can verify at https://dechonet.com/e/<id> (public keys: https://dechonet.com/.well-known/dechonet-receipts.json)
- Optional API key (free) for per-key limits; `infrastructure_pivot` requires one. From 2026-11-08 free use is for non-commercial purposes; commercial use needs MCP·API Pro
- Listed in the Claude connectors directory (https://claude.ai/directory/connectors/dechonet) and the ChatGPT apps directory (https://chatgpt.com/plugins/plugin_asdk_app_6ad19eb55ab88191bba280602423c1a9): one-click Connect
- npm (stdio): `npx dechonet-mcp`
- Setup and tool list: https://dechonet.com/mcp

## Data DechoNet measures

- [Phishing detection benchmark](https://dechonet.com/benchmark): every month our phishing check is measured on fresh public samples it never saw while the rules were written — detection rate with 95% intervals and false warnings on legitimate sites
- [Korean security hygiene index](https://dechonet.com/reports/metrics): HTTPS, TLS 1.3, HSTS, CSP, security headers, DMARC, DMARC enforcement and post-quantum key exchange across Korean organisations by sector — anonymous aggregate, monthly
- [Security advisories](https://dechonet.com/advisories): impersonation domains measured after Korean breach announcements
- [How verdicts are made and their limits](https://dechonet.com/methodology), [service status](https://dechonet.com/status), [open-source data and code we use](https://dechonet.com/open-source)

## Guides

- [Troubleshooting guides](https://dechonet.com/guides): DNS, SSL/TLS, HTTP errors, email delivery — each with an inline diagnostic. Korean: https://dechonet.com/ko/guides
- [Phishing & smishing guides](https://dechonet.com/guides/phishing): telling scam texts apart (parcel, traffic fine, breach compensation, wedding/obituary, card payment alert, family impersonation, short links) and what to do after tapping a link. Korean: https://dechonet.com/ko/guides/phishing
- [Blog](https://dechonet.com/blog)