Open source and data we use
DechoNet works on top of data and software others publish. This page lists what we use, where, and under which licence. Data that requires attribution is also credited in the results and alerts that use it.
Data and rules
| Name | Licence | Used for |
|---|---|---|
| ProjectDiscovery Nuclei templates (technologies) | MIT | Static product signatures on responses already read by the exposure map and HTTP check; no template execution or extra requests. |
| Rapid7 Recog | BSD-2-Clause | Products and visible versions in greetings already read by the port check. |
| MISP warninglists | CC0 1.0 | Parking providers' name servers and addresses, security sinkholes (shared-infrastructure hubs; phishing take-down detection) and link shorteners. |
| CDN providers' published edge lists (Cloudflare, Fastly, Amazon CloudFront, Gcore, Imperva) | Provider-published lists; provider set from projectdiscovery/cdncheck (MIT) | Telling a CDN edge from the origin server (PQC check, exposure map, port check). |
| phishunt | CC0 | Phishing feed: listed hosts are "suspicious" in our checks and tracked for lifetime statistics. |
| TweetFeed | CC0 1.0 | Phishing URLs shared by researchers: lifetime statistics and the monthly benchmark sample. |
| RansomLook | CC BY 4.0 | Ransomware leak-site posts matched to monitored domains (attributed in every alert). |
| PhishDestroy destroylist (main list) | MIT | Phishing and crypto-drainer domains: a listing makes the phishing check say "suspicious". |
| polkadot-js/phishing (deny list) | Apache-2.0 | Crypto scam domains: a listing makes the phishing check say "suspicious". |
| Chrome UX Report (CrUX) | CC BY 4.0 | Korea's 10,000 most visited sites: the phishing check does not warn on what their names alone suggest. |
| EPSS (Exploit Prediction Scoring System) | Free, commercial use confirmed by FIRST (2026-10-20); attribution | Next to exploited-vulnerability alerts and vulnerable JavaScript libraries (HTTP check): the EPSS score (probability of exploitation activity in the next 30 days) and its percentile. Shown for priority, never used to judge. |
| 경찰청 보이스피싱 현황 (data.go.kr) | 공공데이터 — 이용허락범위 제한 없음 | Yearly voice-phishing cases and losses shown as background on the phishing guide hub. |
| wafw00f (block-page signatures) | BSD-3-Clause | When a site answers the HTTP check with a block page, which WAF or bot protection served it — passive markers only, no probes. |
| CISA Known Exploited Vulnerabilities | U.S. Government work (public domain) | Exploited-vulnerability alerts for products seen on monitored domains. |
| KISA 공공데이터 (data.go.kr) | 공공누리 — 이용 제한 없음 | Link shorteners used in Korean smishing; Korean phishing name patterns (offline checks). |
| RetireJS repository | Apache-2.0 | Known-vulnerable JavaScript library versions in the HTTP check (read from script addresses). |
| Cisco AI Defense mcp-scanner (YARA rule patterns) | Apache-2.0 | Agent-steering phrases in MCP tool descriptions (MCP server check, reported MCP servers). |
| Sublime Security static-files | MIT | Link shorteners and free subdomain hosts in the phishing link check (company-tenant and infrastructure platforms left out). |
| Tencent AI-Infra-Guard (fingerprints) | Apache-2.0 | AI servers and agent tools left open (Ollama, ComfyUI, Gradio, Dify …) in the exposure map — front-page matchers only. |
| ssh-audit (algorithm database) | MIT | Weak SSH algorithms and the Terrapin check in the port check (one identification line and the server's algorithm list, no login). |
| IOK — Indicator of Kit (phish.report/IOK) | ODbL-1.0 | Known phishing-kit markup on rendered pages (kit-specific rules only); results that match name the source. |
| mailauth | MIT | Cross-checking our SPF and DMARC reading in tests (not in the product). |
| MDN HTTP Observatory | MPL-2.0 | Cross-checking our security-header results against its public API (measurement only). |
| ioc-extractor (refang patterns) | MIT | Reading defanged links such as hxxps://example[.]com in pasted text and tool input. |
Software
| Name | Licence | Used for |
|---|---|---|
| RE2JS | MIT | Linear-time matching of fixed technology signatures. |
| fflate | MIT | Reading pinned upstream archives when generating technology signatures (build tool only). |
| Astro | MIT | Site framework. |
| micromark | MIT | Markdown rendering. |
| Observable Plot | ISC | Charts. |
| cosmos.gl | MIT | Graph view in the investigator workspace. |
| graphology | MIT | Graph analysis. |
| Playwright (playwright-core) | Apache-2.0 | Opening suspicious links in our renderer. |
| @sparticuz/chromium | MIT | Headless Chromium build for the renderer. |
| zxing-wasm (ZXing C++) | MIT (ZXing C++: Apache-2.0) | Reading a QR image in the phishing check, on the device. |
| Sentry SDK | MIT | Error reporting. |
| js-yaml | MIT | YAML parsing. |
| qrcode-generator | MIT | QR codes for share links. |
| Fontsource (Bebas Neue, Do Hyeon, IBM Plex Sans KR, Nanum Gothic Coding, Space Mono) | SIL Open Font License 1.1 | Fonts. |
How we choose: code only under licences open to commercial use (MIT, Apache, BSD, ISC, MPL); data only CC0, CC BY or public domain. No non-commercial data and no lists merged from other feeds. Code without a licence is not copied.
If an attribution is missing or wrong, tell us at support@dechonet.com.