100% Free Public beta available

Local network security monitor for Windows.

CustosXI helps you understand what happens on your Windows PC network - and take back control. See traffic, DNS, firewall events, and risk signals locally, block noisy domains that harm privacy, blocks domains and IP addresses known to be malicious or dangerous, analyzes and detects malicious traffic through fully configurable signals and reduce risk and wasted data usage.

Download free Why CustosXI

Protect privacy. Save data. Stay local.

CustosXI is built for people who want visibility without giving up control of their network telemetry.

PRIV

Privacy-first visibility

Understand which apps and domains communicate from your PC. Analysis runs locally - your traffic is not uploaded to our servers by default.

DNS

DNS-level protection

See DNS queries in context and block domains that are useless, invasive, or risky - before they turn into full connections.

Local AI anomaly detection

On-device Isolation Forest and statistical baselines flag unusual traffic - no cloud LLM, no external model API. Tune it in Settings → AI / Anomaly.

Public blacklists

Import and refresh community threat feeds (IPs and CIDR ranges). Match traffic against known-bad sources locally - you choose which feeds to enable in Settings.

AGG

DNS sinkhole aggressive mode

When the sinkhole blocks a domain, CustosXI resolves its real IPs via upstream DNS and applies temporary Windows Firewall blocks on those addresses. Block duration escalates if the same IP keeps appearing within a configurable window. Requires sinkhole on - Settings → DNS.

DATA

Less wasted bandwidth

Cut trackers, ads, telemetry, and low-value background calls. Useful on metered links, mobile hotspots, and everyday Windows use.

Want the full story behind the project? Read about CustosXI.

Free to download and use

CustosXI is freeware: no paywall, no hidden premium tier, and donations are optional. Optional add-ons (GeoIP, Suricata, reputation APIs, and more) are under your control in Settings → Add-on.

See CustosXI in action

Screenshots from the Windows app: traffic, risk signals, firewall, entities, and more - all analyzed locally on your PC.

Click any screenshot to view it full size.

Overview screenshot — **Overview**High-level network activity at a glance.

Live traffic screenshot — **Live traffic**Real-time connections and flows.

Entity details screenshot — **Entity details**Drill into hosts, IPs, and related events.

Signals screenshot — **Signals**Risk and behavior signals for investigation.

AI anomaly screenshot — **AI anomaly**Anomaly detection and AI-assisted investigation signals.

Firewall events screenshot — **Firewall events**Windows firewall activity in context.

Timeline screenshot — **Timeline**Chronological view of network events.

ASN screenshot — **ASN**Correlate traffic with autonomous systems.

Country screenshot — **Country**Geographic breakdown of external communication.

Top risk screenshot — **Top risk**Prioritize the most relevant risk items.

Unique IPs screenshot — **Unique IPs**External destinations seen on the system.

Traceroute screenshot — **Traceroute**Path visibility for remote endpoints.

Public blacklist screenshot — **Public blacklist**Feed-based reputation context.

Log Center screenshot — **Log Center**Browse JSONL logs, filter by level, search, and live tail.

Database settings screenshot — **Database settings**Local storage and retention options.

Local visibility, no magic promises.

CustosXI does not replace antivirus, firewalls, or enterprise SIEM. It is a local tool to observe, understand, and investigate Windows network behavior. Public beta: many areas are still being improved.

NET

Traffic & connections

View communications, hosts, ports, external IPs, and signals useful for local analysis.

DNS

DNS & destinations

Read DNS queries, remote destinations, and context about what your system talks to.

ASN

ASN & risk

Correlate external IPs and autonomous networks to highlight interesting or suspicious traffic.

Firewall events

Bring firewall events into a clearer view linked to the rest of your telemetry.

IDS

Optional Suricata

Display Suricata EVE JSON alerts in a local Windows dashboard.

LOC

Local-first

Focused on local analysis and transparency about components, privileges, and requirements.

Legal & transparency

CustosXI is free freeware. Privacy, terms, security disclosure, and third-party notices are published openly.

Privacy

Website vs app - local-first, no automatic upload of traffic to our servers.

Terms

Beta software, acceptable use, no warranty, not a full security suite.

License

Freeware - free personal/lab use; no redistribution without permission.

Security

Safe downloads and security@custosxi.com for reports.

Third-party

Open-source libraries and optional add-ons - thank you to all contributors.

Legal

Project owner, Italy, official contacts.

Free download Latest Beta

Download the beta

Official Windows installer. Bundles CustosXI, .NET 10, and required runtimes. Many features are still maturing - see About for AI and beta scope. Npcap, Suricata, PostgreSQL, and GeoLite2 are not included - install or configure separately.

Download CustosXI Read requirements

SHA-256 hash and detailed changelog will be published with upcoming releases. Credits: Third-party notices.

Available installer builds

Verified builds published on downloads.custosxi.com with file details from R2.

Latest direct link: /download/windows/latest

Loading available builds...