Third-party notices

CustosXI builds on open-source software and optional external tools. This page mirrors the in-app attribution in Settings → About → View Third-Party Licenses.

Download summary (THIRD-PARTY-NOTICES.txt)

Not included in the CustosXI installer

The official Windows installer ships CustosXI and its bundled runtimes/libraries. The following are not distributed with CustosXI and must be obtained and installed separately by you when you choose to use those features:

  • Npcap - required for live packet capture (SharpPcap depends on it). Install from npcap.com; WinPcap API-compatible mode is recommended. Without Npcap, DNS sinkhole, firewall, blacklist, and most UI features still work.
  • Suricata IDS/IPS - optional, independent GPL v2 project. CustosXI can read eve.json and correlate alerts when you install Suricata yourself and configure paths in Settings. Suricata binaries, rules, and updates are your responsibility.
  • PostgreSQL server - optional database backend. Only the Npgsql client library is bundled; you install and operate PostgreSQL separately if you use it instead of the default SQLite storage.
  • MaxMind GeoLite2 database - optional geolocation data file (.mmdb). Downloaded by you via app add-ons (Account ID + license key) or supplied at build time; not redistributed as part of the default installer unless explicitly stated for a specific build.

These choices are intentional for licensing, size, and security reasons. The installer welcome text and in-app Health Center repeat the same guidance.

Included in the CustosXI installer

  • CustosXI application - UI (WinUI 3), Worker Windows service, system tray, and elevated Helper for DNS operations
  • .NET 10 runtime - self-contained with the published application
  • Windows App SDK Runtime 1.8 (x64) - installed by CustosXI-Setup.exe before the main MSI when missing on the PC
  • Open-source libraries listed below (via NuGet, published into the app output)
  • Leaflet, bundled map assets, flag images, and default port/service reference data
  • LICENSE.txt and THIRD_PARTY_LICENSES.txt in the application directory

Bundled open-source libraries

Direct NuGet dependencies in the current CustosXI codebase. Additional transitive packages may apply; the in-app license viewer is authoritative for your installed build.

  • SharpPcap - LGPL 3.0 - packet capture in Worker components (users may replace the SharpPcap DLL as permitted by LGPL)
  • PacketDotNet - MIT - packet parsing (transitive dependency via SharpPcap)
  • System.Data.SQLite.Core - Public Domain / SQLite & System.Data.SQLite packaging terms - local SQLite access
  • Microsoft.Data.Sqlite - MIT - SQLite access in PublicBlacklist module
  • System.Data.SqlClient - MIT - SQL Server client compatibility scenarios
  • Npgsql - PostgreSQL License - client library only for optional PostgreSQL connectivity
  • Microsoft.Extensions.Hosting / Hosting.WindowsServices - MIT - generic host and Windows service infrastructure
  • System.ServiceProcess.ServiceController - MIT - Windows Service control and status
  • Windows App SDK / WinUI 3 (Microsoft.WindowsAppSDK) - MIT - desktop UI framework
  • CommunityToolkit.WinUI.Collections - MIT - UI collection helpers
  • MaxMind.GeoIP2 - Apache 2.0 - GeoIP reader APIs for local MaxMind databases (database file separate; see above)

Bundled UI assets and reference data

  • Leaflet (leaflet.js / leaflet.css) - BSD 2-Clause - interactive map rendering
  • World map GeoJSON (world.geo.json) - country geometry; retain upstream attribution if replaced
  • Default port/service reference data - IANA-style static reference (not a live nmap installation)

Optional databases and feeds (configured in the app)

These are not bundled. CustosXI may download or query them only when you enable the relevant add-on or enter URLs/API keys in Settings. You must comply with each provider's terms and quotas.

  • Threat intelligence / blocklists - e.g. AbuseIPDB, ThreatFox, MISP exports, Spamhaus DROP, URLhaus, StevenBlack hosts, Emerging Threats, FireHOL, blocklist.de, and custom feed URLs
  • Geo enrichment APIs - ip-api.com, ipinfo.io (when configured)
  • WHOIS / RDAP - configurable registries (e.g. RADB, ARIN, RIPE, LACNIC, APNIC)
  • ASN database - e.g. iptoasn.com combined TSV
  • TLS fingerprint databases - JA3 (SSLBL / abuse.ch), JA4 (user-configured URL)
  • Suricata rules - e.g. Emerging Threats open rules (requires separately installed Suricata)
  • IANA port assignments CSV - service name reference updates
  • OpenStreetMap tiles - used in traceroute map views (tile.openstreetmap.org)

Build-time only (not shipped inside the app)

  • WiX Toolset - Microsoft Reciprocal License (MS-RL) - MSI/installer build toolchain

Website and support infrastructure

  • Cloudflare - Pages, CDN, security (no marketing tracker scripts in site HTML)
  • PayPal - voluntary donations (external checkout)

Icons and fonts

Segoe UI and system fonts on Windows; WinUI symbol fonts where applicable. No proprietary icon packs are claimed as CustosXI-owned assets unless stated in the application.

Legal notes

  • Third-party names, trademarks, and logos belong to their respective owners.
  • CustosXI does not claim ownership of third-party software, drivers, or data.
  • For definitive license text, refer to each upstream project and to View Third-Party Licenses in the installed application.