Everything your apps do online, in plain words
Defendingo watches quietly in the background and turns raw network traffic into a story you can actually read.
Watching
Every connection, live
Outgoing, incoming and open doors (ports). With full recording on, Windows itself tells Defendingo about every connection, even ones that last a split second. Without it, Defendingo checks once a second.
Always on guard
Starts with your computer and runs quietly in the background. Closing the window never stops the watching.
New places stand out
The first time an app ever talks to a new server, it's marked as new. The easiest way to notice something changed.
Investigating
Run with Defendingo
Right-click a program's file and choose "Run with Defendingo". It starts normally, and you see a live log of exactly what it does online. On Windows 11 the option is under "Show more options". It works on the program's .exe file, not on shortcuts: right-click a shortcut, choose "Open file location", then right-click the file it shows.
Follows what it starts
Helpers, updaters and anything else the program launches are watched too, as they start and stop. Nothing sneaks out the side door.
Watch live and summary
Already running? Press "Watch live" on any app. When the program closes, you get a summary: how many places it talked to, which ones, and any warnings.
Understanding
Names instead of numbers
Addresses become websites and companies: Cloudflare, Amazon, Google, Microsoft, Steam, Discord and many more.
Clear categories
Every connection is sorted: games, browsers, Windows, rented cloud servers, delivery networks, your home network and unknown.
Warnings with reasons
Each warning says exactly what was noticed and why it matters, so you can decide in seconds whether to care.
Remembering
90 days of history
Everything is kept for three months on your own computer, then cleaned up automatically. Nothing is uploaded.
Search everything
Filter by app, website, company, category, direction or risk, over the last day, week, month or all 90 days.
Every app, profiled
Real icons, who signed each program, how many places it talks to and its worst warning. Spot unsigned apps with one click.
Staying out of your way
Featherweight
The background guard uses about 20 MB of memory and barely any processor time. You won't notice it, even in games.
Updates itself safely
New versions install automatically, and only after their digital signature checks out.
Watches, never touches
Defendingo never blocks, deletes or changes anything, so it can't break your apps or games.
What each warning means
A warning means "have a look", not "you are hacked". Here is everything Defendingo can tell you, from most to least serious. Digitally signed means the maker put a tamper-proof name stamp on the program, so Windows can confirm who made it.
The program's name stamp is broken or was withdrawn. The file may have been changed after it was made.
A program with no name stamp, running from Downloads, Temp or another folder where real installed apps rarely live, talks to the internet.
The app uses a tunnel service like ngrok or serveo that can open your computer to the outside or connect it to someone else's server. (Some other tunnel services count as a warning.)
The app talks to a service malware often uses to pass on stolen data or get instructions, like Telegram bots, Pastebin or free "dynamic" web addresses.
A program nobody has signed talks to the internet. Many small games are unsigned, but so is most malware.
A program nobody has signed opens a door (port) that other computers can connect to.
A program that isn't Discord or a browser contacts Discord. Account stealers often send what they take this way.
The connection uses a door number (port) that remote-control malware is known for.
A signed program runs straight from Downloads or Temp. From AppData it's only a heads-up: some real apps live there, but malware likes it too.
The app connects straight to a numeric address it never looked up by name, as if it was built into the program. Only checked when your PC's own name lookups are visible (not with some VPNs or private DNS).
The program is signed, but in a way your computer doesn't trust, such as an expired or self-made stamp.
The app asks a website for your public internet address, which malware often does first. Plenty of normal apps do it too.
The first time this app ever talked to this server. Usually harmless, always worth knowing.
Who is on the other end
Every destination lands in one of these groups, so you can read your network at a glance.
Windows itself and Microsoft programs: updates, security, the Store, OneDrive.
Steam, Epic, Riot, Battle.net, Discord and other game services.
The websites you have open in Chrome, Edge, Firefox, Opera and others.
Cloudflare, Akamai, Fastly and friends. They sit in front of many websites and hide who the real owner is.
Rented servers at Amazon, Microsoft Azure, Google Cloud and others. Anyone can rent these.
Well-known companies such as Google, Apple, Meta, GitHub, Spotify and Netflix.
Your router, printer, phone, TV and other devices at home.
Not in any list. Not bad by itself: just look at which app it is.
