Free Threat Intelligence Services in the US: DugganUSA STIX Feed

By Patrick Duggan, DugganUSA LLC • April 2, 2026

DugganUSA provides free threat intelligence services to organizations across the United States. Our STIX 2.1 feed delivers 653,342 distinct indicators of compromise from 15 upstream sources — and the free tier costs $0/month, no credit card required (a free registered API key is required; the feed is key-enforced and anonymous requests are rejected).

What You Get for Free

• 25 API calls/day — enough to evaluate the feed; upgrade to Pro ($99/mo) for 2,000/day
• STIX 2.1 feed access — 653,342 distinct indicators from URLhaus, ThreatFox, Spamhaus DROP, PhishTank, and more
• 2 search indexes — query threat intelligence data directly
• OPNsense blocklists — IP, domain, and URL blocklists for firewall integration
• SIEM integration guides — step-by-step setup for Splunk, Sentinel, CrowdStrike, Cortex XSOAR, Wiz, and OPNsense

Who Uses DugganUSA

DugganUSA's threat intelligence feed is consumed by 77 active API keys. US customers include enterprises, government agencies, financial institutions, healthcare organizations, and managed security service providers (MSSPs). The platform serves organizations in California, New York, Texas, Florida, Washington, and all 50 states.

How to Get Started

1. Register: Create a free account at analytics.dugganusa.com/stix/register
2. Get your API key: Claim your Bearer token from the dashboard
3. Connect your SIEM: Point your STIX/TAXII connector to https://analytics.dugganusa.com/api/v1/stix/feed
4. Start blocking threats: IOCs flow into your security stack automatically

Paid Tiers for Larger Organizations

Need more than 25 calls/day? DugganUSA now offers three simple tiers: Free ($0, 25/day), Pro ($99/mo, 2,000/day with 24h email SLA), and Enterprise ($995/mo, 50,000/day with 4h response SLA and white-glove onboarding). All tiers include the same high-quality IOCs from DugganUSA's 3-layer cascade pipeline. Compare plans.

Why DugganUSA Over Other Free Feeds

Unlike raw OSINT feeds, DugganUSA applies multi-framework validation (CARVER, DREAD, Diamond Model, ACH) through a 3-layer cascade pipeline. This means fewer false positives, richer context, and IOCs validated through behavioral scoring — not just signature matching. The platform has resolved 2.9M block events to 12,216 distinct hosts, a process that runs continuous decisions, resolving 2.9M block events to 12,216 distinct hosts. 81.3% were caught behaviourally, on no blocklist anywhere.