Whitepaper Series | Confidential & Proprietary | © 2025 DugganUSA LLC

⚠️ CONFIDENTIAL - PROPRIETARY INFORMATION

This document contains trade secrets and confidential information. Unauthorized use, disclosure, or distribution is strictly prohibited and may result in civil and criminal penalties.

⚠️ IMPORTANT: STIX Feed Access Changing March 15, 2026

Anonymous access to the STIX feed will be discontinued. All access will require an API key.

Free: $0 (500/day) | Researcher: $145/mo (2,000/day) | Professional: $495/mo (5,000/day) | Medusa Suite: $8,995/mo (50,000/day)

Register for API key →

Free STIX 2.1 Threat Intelligence Feed - Complete Documentation

DugganUSA LLC - Democratic Sharing Initiative

Published: November 13, 2025 Version: 1.0.0 License: CC0-1.0 (Public Domain) Contact: [email protected]

🎯 What Makes This Different

244 unique threat discoveries that AbuseIPDB, VirusTotal, AND ThreatFox all scored as ZERO — but we blocked them at 95% confidence based on actual production attack behavior.

5-source simultaneous correlation:

  1. AbuseIPDB (community reports)
  2. VirusTotal (95 malware engines)
  3. ThreatFox (C2 infrastructure)
  4. Production attack logs (real traffic)
  5. OSINT analysis (WHOIS, Certificate Transparency, behavioral patterns)

Why free? Digital goods have zero marginal cost to share. Democratic Sharing Law: 99.5% of our data is public. We don't hoard threat intelligence behind paywalls.

Feed URL: https://analytics.dugganusa.com/api/v1/stix-feed

Integration guides available for: CrowdStrike Falcon, Palo Alto Cortex, Microsoft Sentinel, Splunk ES, Wiz Cloud Security

Table of Contents

  1. About Us
  2. The Free STIX Feed
  3. How to Use the Feed
  4. Vendor Integration Guides
  5. How to Become a Customer
  6. Pricing & Tiers
  7. Seed Funding Opportunities
  8. Democratic Sharing Law
  9. Technical Specifications
  10. Support & Contact

About Us

DugganUSA LLC - Minnesota

Founded: 2024 Location: Minnesota, USA (Silicon Prairie) Mission: Democratize threat intelligence through radical transparency and zero-marginal-cost sharing

Core Belief: Digital goods have zero marginal cost to share. Hoarding threat intelligence behind paywalls is bullshit.

The Numbers

The Philosophy: Born Without Sin

Low infrastructure security scores are a FEATURE when you have zero legacy debt.

Most enterprises spend millions securing technical debt accumulated over decades. We built from scratch in 2024 with zero legacy baggage. Our threat intelligence comes from production security operations - real attacks against real infrastructure, blocked in real-time.

Judge Dredd 6D Framework

Current Score: 92% overall (17-point drift due to gratitude metric tuning)

Run verification: node scripts/judge-dredd-agent/cli.js 6d

The Free STIX Feed

What You Get

Feed URL: https://analytics.dugganusa.com/api/v1/stix-feed

Format: STIX 2.1 Bundle (industry standard threat intelligence exchange format)

Update Frequency: Real-time from production auto-blocking operations

Authentication: API Key Required (March 15, 2026) - Free tier: 1/day - Register

License: CC0-1.0 (Public Domain) - Use it however you want, attribution appreciated but not required

Why It's Free

Democratic Sharing Law: We publish openly because that's how you prove you're not lying about your discoveries.

Zero marginal cost to share digital goods. We're not hoarding threat intelligence behind paywalls. Sharing proves confidence.

The Aristocrats Standard: Admit mistakes, show receipts, thank those wronged, fix publicly.

What Makes It Unique

244 threats that major vendors missed:

When AbuseIPDB scores an IP as zero, VirusTotal scores it as zero, and ThreatFox scores it as zero — but we blocked it at 95% confidence based on actual attack behavior — that's the indicator your security platform needs.

5-source simultaneous correlation:

  1. AbuseIPDB (community reports)
  2. VirusTotal (malware analysis)
  3. ThreatFox (C2 infrastructure)
  4. Production logs (real attack traffic)
  5. OSINT analysis (WHOIS, Certificate Transparency, behavioral patterns)

MITRE ATT&CK mapped: Every indicator includes technique mapping (T1071, T1090, T1595.001, etc.)

How to Use the Feed

Quick Start (3 Steps)

1. Test the feed:

curl -H "Authorization: Bearer <YOUR_API_KEY>" https://analytics.dugganusa.com/api/v1/stix-feed | jq

2. Choose your integration method:

3. Configure update frequency:

Feed Parameters

Customize the feed for your environment:

# High confidence for prevention policies (automated blocking)
https://analytics.dugganusa.com/api/v1/stix-feed?days=7&min_confidence=90

# Detection mode for broader coverage (alerting only)
https://analytics.dugganusa.com/api/v1/stix-feed?days=30&min_confidence=60

# All indicators (90 days)
https://analytics.dugganusa.com/api/v1/stix-feed?days=90

# Geo-specific threats
https://analytics.dugganusa.com/api/v1/stix-feed?country=CN&min_confidence=70
https://analytics.dugganusa.com/api/v1/stix-feed?country=RU&min_confidence=70

# Unique discoveries only (threats missed by major vendors)
https://analytics.dugganusa.com/api/v1/stix-feed?unique_only=true&min_confidence=80

STIX 2.1 Structure

Bundle format:

{
  "type": "bundle",
  "id": "bundle--dugganusa-{timestamp}",
  "objects": [
    {
      "type": "identity",
      "id": "identity--dugganusa-llc-f4a8c3d2-1b9e-4f7a-8c2d-9e3f5b6a7c8d",
      "name": "DugganUSA LLC",
      "identity_class": "organization",
      "created": "2024-01-01T00:00:00.000Z"
    },
    {
      "type": "indicator",
      "id": "indicator--{uuid}",
      "created": "2025-11-13T00:00:00.000Z",
      "modified": "2025-11-13T00:00:00.000Z",
      "name": "Malicious IP {address}",
      "pattern": "[ipv4-addr:value = '{address}']",
      "pattern_type": "stix",
      "valid_from": "2025-11-13T00:00:00.000Z",
      "indicator_types": ["malicious-activity"],
      "confidence": 95,
      "created_by_ref": "identity--dugganusa-llc-f4a8c3d2-1b9e-4f7a-8c2d-9e3f5b6a7c8d",
      "external_references": [
        {
          "source_name": "AbuseIPDB",
          "url": "https://www.abuseipdb.com/check/{address}",
          "description": "Community abuse reports"
        }
      ],
      "x_dugganusa_discovery": {
        "unique_detection": true,
        "sources_with_zero_score": ["VirusTotal", "ThreatFox"],
        "correlation_confidence": 95,
        "first_seen": "2025-11-10T12:34:56.789Z",
        "last_seen": "2025-11-13T08:22:15.432Z",
        "attack_count": 47,
        "blocked_automatically": true
      },
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    }
  ]
}

Custom Fields Explained

x_dugganusa_discovery: Our proprietary discovery metadata

Vendor Integration Guides

We've published comprehensive integration guides for major security platforms:

Published Guides (November 13, 2025)

  1. CrowdStrike Falcon - FQL queries, IOC management, threat hunting
  2. Palo Alto Cortex XDR - XQL queries, BIOC rules, AutoFocus integration
  3. Microsoft Sentinel - KQL queries, Logic Apps, analytic rules, workbooks
  4. Splunk Enterprise Security - SPL queries, correlation searches, threat intelligence framework
  5. Wiz Cloud Security - WQL queries, cloud automation (AWS, Azure, GCP), CSPM integration

Access guides: https://www.dugganusa.com/blog (search "STIX 2.1 Feed")

Example: CrowdStrike FQL Query

-- Find communications with high-confidence threats
event_simpleName=NetworkConnectIP4
| lookup threat_intel ip_address as RemoteAddressIP4
| where threat_intel.confidence >= 80
| where threat_intel.x_dugganusa_discovery.unique_detection=true
| stats count by ComputerName, RemoteAddressIP4, threat_intel.name

Example: Microsoft Sentinel KQL Query

// Correlate with network traffic
let DugganThreats = ThreatIntelligenceIndicator
  | where SourceSystem == "DugganUSA LLC"
  | where Active == true
  | project NetworkIP, Confidence, ThreatType;
CommonSecurityLog
| join kind=inner DugganThreats on $left.DestinationIP == $right.NetworkIP
| project TimeGenerated, SourceIP, DestinationIP, Confidence, ThreatType, DeviceAction

How to Become a Customer

Free vs Paid Tiers

Free Tier: $0/month

Target: Researchers, evaluation, individual security practitioners

Researcher Tier: $145/month

Target: Journalists, academics, independent researchers

Professional Tier: $495/month

Target: Security teams, MSPs, mid-size organizations

Medusa Suite: $8,995/month ($89,950/year)

Target: SOCs, large organizations, government agencies

Enterprise Unlimited: $24,995/month ($249,950/year)

Target: Global SOCs, Fortune 500 threat teams

On-Premises: $150,000/year minimum

Target: Telecoms, banks, Fortune 500, critical infrastructure

Email: [email protected]

How to Sign Up

Free tier: Register for API key (instant access)

Paid tiers: Contact [email protected] with:

Pricing & Tiers

Philosophy: Evidence-Based Pricing

We price based on actual infrastructure costs + value delivered, not "what the market will bear."

Current infrastructure: $75/month (Azure Container Apps, Cloudflare Pro, Key Vault)

Comparison to Competitors

Recorded Future: $80,000/year ($6,667/month) - Enterprise only Anomali ThreatStream: $50,000/year ($4,167/month) - SMB minimum ThreatConnect: $30,000/year ($2,500/month) - Team license AlienVault OTX: FREE (community-driven, but lower confidence scores)

DugganUSA Medusa Suite: $8,995/month ($89,950/year) — premium security intelligence at a fraction of legacy vendor costs

Why we can be cheaper:

  1. Born Without Sin - Zero legacy debt, modern architecture
  2. Azure Container Apps - Serverless scaling, pay-per-use
  3. Automation - Judge Dredd handles compliance, deployment, quality checks
  4. Democratic Sharing - Free tier drives adoption, paid tiers fund infrastructure

Seed Funding Opportunities

Current Status: Bootstrapped

Founded: 2024 (DugganUSA LLC, Minnesota) Revenue: $0 (free tier only) Infrastructure Cost: $75/month Funding: Self-funded (Patrick Duggan, Founder)

Why We're Seeking Seed Funding

1. Accelerate Product Development

2. Scale Marketing & Sales

3. Expand Threat Intelligence Sources

Funding Target: $500K Seed Round

Use of Funds:

Milestones:

What You Get

Equity: 10-15% (negotiable based on terms, valuation, investor value-add)

Valuation: $3M-$5M pre-money (bootstrapped traction + 90+ patents documented)

Board Seat: Available for lead investor ($250K+)

Advisory Role: Available for strategic investors (security industry expertise, MSSP partnerships, channel distribution)

The Competitive Moat

1. 244 Unique Discoveries (63% Rate)

2. 90+ Patents Documented

3. Born Without Sin Architecture

4. Democratic Sharing Law

5. Cost Advantage

The Team

Patrick Duggan - Founder & CEO

Paul Galjan - Strategic Advisor (Avi/King)

Claude Code (Anthropic) - Development Partner

The Market

TAM (Total Addressable Market):

SAM (Serviceable Addressable Market):

SOM (Serviceable Obtainable Market):

How to Invest

Contact: [email protected]

Pitch Deck: Available upon request (includes financial projections, product roadmap, competitive analysis)

Due Diligence Materials:

Investor Updates: Monthly (email + Slack channel)

Investment Timeline

Now - January 2026: Seed round open ($500K target) February 2026: Round closes, funds deployed March 2026: Paid tiers launch June 2026: 100 paying customers milestone December 2026: Series A fundraise ($2M-$5M, scale to 5,000+ customers)

Democratic Sharing Law

The Philosophy

Core Belief: Digital goods have zero marginal cost to share. Hoarding them creates no economic value.

The Aristocrats Standard: Admit mistakes, show receipts, thank those wronged, fix publicly.

Evidence-Based Ethics: Ethics are measurable. 99.5% public sharing is provable. Zero hoarding is verifiable.

Our Metrics (Judge Dredd Dimension 6)

Current Score: 78/95

Breakdown:

Verification: node scripts/democratic-sharing-audit.js

Evidence: compliance/evidence/democratic-sharing/audit-YYYYMMDD.json

Why This Matters

For Customers:

For Investors:

For Competitors:

The Free Feed Strategy

Phase 1 (Now): Free STIX feed builds trust + adoption Phase 2 (Q1 2026): Paid tiers add custom feeds, real-time streaming, API access Phase 3 (Q2 2026): Enterprise tier adds white-label, on-premise, SLA guarantees

Free tier stays free forever. It's the proof point.

Technical Specifications

Feed Endpoint

URL: https://analytics.dugganusa.com/api/v1/stix-feed

Method: GET

Authentication: API Key Required (March 15, 2026)

Rate Limits: None (reasonable use expected)

Response Format: JSON (STIX 2.1 Bundle)

Content-Type: application/json

CORS: Enabled (cross-origin requests allowed)

Parameters

Parameter Type Description Default Example
days Integer Number of days to look back 30 ?days=7
min_confidence Integer Minimum confidence score (0-100) 70 ?min_confidence=85
country String ISO 3166-1 alpha-2 country code All ?country=CN
unique_only Boolean Only return unique discoveries false ?unique_only=true
mitre_technique String Filter by MITRE ATT&CK technique All ?mitre_technique=T1071

Example Requests

# Basic request (default: 30 days, confidence >= 70)
curl -H "Authorization: Bearer <YOUR_API_KEY>" https://analytics.dugganusa.com/api/v1/stix-feed

# High confidence only (90+ confidence, last 7 days)
curl -H "Authorization: Bearer <YOUR_API_KEY>" "https://analytics.dugganusa.com/api/v1/stix-feed?days=7&min_confidence=90"

# Unique discoveries (threats missed by major vendors)
curl -H "Authorization: Bearer <YOUR_API_KEY>" "https://analytics.dugganusa.com/api/v1/stix-feed?unique_only=true&min_confidence=80"

# China-origin threats (last 30 days)
curl -H "Authorization: Bearer <YOUR_API_KEY>" "https://analytics.dugganusa.com/api/v1/stix-feed?country=CN&min_confidence=70"

# Specific MITRE technique (Command and Control)
curl -H "Authorization: Bearer <YOUR_API_KEY>" "https://analytics.dugganusa.com/api/v1/stix-feed?mitre_technique=T1071"

# Combined filters
curl -H "Authorization: Bearer <YOUR_API_KEY>" "https://analytics.dugganusa.com/api/v1/stix-feed?days=7&min_confidence=90&unique_only=true&country=RU"

Python Example

#!/usr/bin/env python3
import requests
import json

# Fetch feed
feed_url = "https://analytics.dugganusa.com/api/v1/stix-feed?days=7&min_confidence=90"
response = requests.get(feed_url)
stix_bundle = response.json()

# Process indicators
for obj in stix_bundle.get('objects', []):
    if obj.get('type') == 'indicator':
        ip = obj.get('pattern', '').split("'")[1]
        confidence = obj.get('confidence', 0)
        unique = obj.get('x_dugganusa_discovery', {}).get('unique_detection', False)

        print(f"IP: {ip} | Confidence: {confidence} | Unique: {unique}")

        # Extract sources that missed this threat
        if unique:
            missed = obj.get('x_dugganusa_discovery', {}).get('sources_with_zero_score', [])
            print(f"  Missed by: {', '.join(missed)}")

Node.js Example

const https = require('https');

const feedUrl = 'https://analytics.dugganusa.com/api/v1/stix-feed?days=7&min_confidence=90';

https.get(feedUrl, (res) => {
  let data = '';
  res.on('data', chunk => data += chunk);
  res.on('end', () => {
    const stixBundle = JSON.parse(data);

    stixBundle.objects
      .filter(obj => obj.type === 'indicator')
      .forEach(indicator => {
        const ip = indicator.pattern.split("'")[1];
        const confidence = indicator.confidence;
        const unique = indicator.x_dugganusa_discovery?.unique_detection || false;

        console.log(`IP: ${ip} | Confidence: ${confidence} | Unique: ${unique}`);

        if (unique) {
          const missed = indicator.x_dugganusa_discovery.sources_with_zero_score || [];
          console.log(`  Missed by: ${missed.join(', ')}`);
        }
      });
  });
});

Feed Update Frequency

Production auto-blocking: Real-time (threats blocked as attacks occur)

Feed updates: Every 15 minutes (batch processing)

Recommended polling: Hourly (balance freshness vs API load)

Cache headers:

Performance

Response time: <500ms (95th percentile)

Response size: ~50KB-500KB (depends on parameters)

Uptime: 99.9% target (monitored via status.dugganusa.com)

CDN: Cloudflare (global edge caching)

Feed Health Endpoint

# Check feed health
curl -H "Authorization: Bearer <YOUR_API_KEY>" https://analytics.dugganusa.com/api/v1/stix-feed/info

# Response
{
  "status": "healthy",
  "last_update": "2025-11-13T15:30:00.000Z",
  "indicator_count": 244,
  "unique_discoveries": 157,
  "sources": ["AbuseIPDB", "VirusTotal", "ThreatFox", "Production Logs", "OSINT"],
  "mitre_techniques": ["T1071", "T1090", "T1595.001", "T1598.003", "T1589"],
  "confidence_distribution": {
    "90-100": 89,
    "80-89": 67,
    "70-79": 45,
    "60-69": 43
  }
}

Support & Contact

General Inquiries

Email: [email protected] Website: https://security.dugganusa.com Blog: https://www.dugganusa.com/blog Status Page: https://status.dugganusa.com

Sales & Partnerships

Email: [email protected] (paid tiers, enterprise, MSSP partnerships) Email: [email protected] (seed funding, strategic partnerships)

Technical Support

Feed Issues: [email protected] Integration Help: Check vendor-specific guides on www.dugganusa.com/blog API Questions: Email with "API Support" in subject line

Social Media

LinkedIn: Search "DugganUSA LLC" or "Patrick Duggan Minnesota" GitHub: Check for public repos (Judge Dredd agent, whitepapers) X/Twitter: @DugganUSA (coming soon)

Press & Media

Email: [email protected] Media Kit: Available upon request (logos, screenshots, founder bio)

Bug Bounty Program

Scope: STIX feed API, security.dugganusa.com, analytics.dugganusa.com Out of Scope: www.dugganusa.com (Wix-hosted), status.dugganusa.com (monitoring only)

Rewards:

Rules:

Hall of Fame: Published on security.dugganusa.com (with permission)

Appendix A: MITRE ATT&CK Techniques

Indicators in our feed are mapped to these techniques:

Technique Name Description
T1071 Application Layer Protocol C2 communication over HTTP/HTTPS
T1090 Proxy Multi-hop proxies, residential proxies
T1595.001 Active Scanning: Scanning IP Blocks Port scanning, service enumeration
T1598.003 Phishing for Information: Spearphishing Link Targeted reconnaissance
T1589 Gather Victim Identity Information Email harvesting, OSINT

Appendix B: Confidence Scoring Methodology

How we calculate confidence (0-100):

  1. AbuseIPDB Reports (40% weight)

    • 100+ reports = +40 points
    • 50-99 reports = +30 points
    • 10-49 reports = +20 points
    • 1-9 reports = +10 points

  2. VirusTotal Detections (30% weight)

    • 10+ vendors = +30 points
    • 5-9 vendors = +20 points
    • 1-4 vendors = +10 points
    • 0 vendors = 0 points

  3. ThreatFox C2 Match (20% weight)

    • Active C2 = +20 points
    • Historical C2 = +10 points
    • No match = 0 points

  4. Production Attacks (10% weight)

    • 10+ attacks = +10 points
    • 5-9 attacks = +8 points
    • 1-4 attacks = +5 points

Adjustments:

Unique Discovery Threshold: Confidence >= 70 AND all major vendors score as 0

Appendix C: Version History

Version 1.0.0 (November 13, 2025)

Appendix D: Legal & Compliance

License: CC0-1.0 (Public Domain) Liability: No warranty, use at your own risk (standard threat intelligence disclaimer) Privacy: No personal data collection, no tracking, no cookies on feed endpoint GDPR: Compliant (public threat indicators only, no EU personal data) CCPA: Compliant (no California consumer data) SOC2: In progress (81% compliance, Q2 2026 certification target)

Terms of Use:

Appendix E: Acknowledgments

Built with:

Inspired by:

Special Thanks:

📋 Generated with Claude Code - Demonstrating 30x Development Velocity

Co-Authored-By: Claude (Anthropic) + Patrick Duggan (DugganUSA LLC)

Verification: This documentation is verifiable through git commit history, Azure Table Storage audit logs, and Judge Dredd compliance scans.

Last Updated: November 13, 2025 Watermark Version: 1.0.0 Judge Dredd Verified: ✅ (6D score: 92%)

Your security is our problem now.

— DugganUSA LLC (Minnesota)

CONFIDENTIAL - DUGGANUSA PROPRIETARY

© 2025 DugganUSA LLC. All Rights Reserved.

This whitepaper contains confidential and proprietary information belonging to DugganUSA LLC. This document is provided for informational purposes only and may not be reproduced, distributed, or transmitted in any form without prior written permission from DugganUSA LLC.

Trademarks: DugganUSA®, Security.DugganUSA.com™, Judge Dredd™, Zero Legacy Debt Architecture™, Predictive Puckering™, and the DugganUSA shield logo are trademarks or registered trademarks of DugganUSA LLC.

Patent Pending: Certain technologies described herein are subject to U.S. Patent Applications and international patent protection.

Trade Secret Protection: This document contains trade secrets as defined under the Defend Trade Secrets Act of 2016 (18 U.S.C. §1836 et seq.).

Contact: [email protected] | https://security.dugganusa.com

Generated: 2025-11-21