DugganUSA Edge Shield
DugganUSA turns scattered public threat reporting into feeds and pre-install checks a small team can use in minutes. It cites its sources, says what it does not know, and corrects itself in public.
Free API key: https://analytics.dugganusa.com/stix/register. One key covers the feed, the API, the MCP servers, Edge Shield and the Checks Action. Questions: https://docs.dugganusa.com/faq/
Docs: https://docs.dugganusa.com/firewall/edge-shield/
You do you. I do me. We share contexts.
Your origin keeps its core; the Worker enforces the DugganUSA Feed's context at your edge, before traffic reaches you.
We watched the open internet, then built the membrane between your AI agents and everything they install, call, read and obey. Edge Shield is the membrane's edge plane.
Threat intelligence you can check, enforced at the Cloudflare edge. Free. Open source.
Posture:
DugganUSA's threat feed at your edge, plus behavioral blocking. Deploy in 30 seconds.
Behavioral blocking at the edge, alongside the list. Over 16 measured days the shield stopped 1,638 distinct attacking hosts, where the blocklist working alone would have stopped 55.
Get Your Free API Key • DugganUSA Feed • Blog • AIPM
Set it up with Claude
Clone the repo, open it in Claude Code, and say "set this up for me."
git clone https://github.com/pduggusa/dugganusa-edge-shield.git
cd dugganusa-edge-shield
claude
Claude follows the playbook in CLAUDE.md, one question at a time with a recommended default for each: which of your hosts to protect and which are sensors that must never be shielded, block or observe-first, your min_confidence, honeypots, rate limits and feed-hit reporting. It writes your wrangler.local.toml, has you set the API key yourself (never in chat), shows a dry run before deploying, and proves the result with live probes (scripts/verify.sh). Every policy knob is a documented [vars] entry in wrangler.example.toml.
What's New in 2.5.0
Your security preferences are config, not code. Block or observe mode, IOC on/off, min_confidence, feed window, refresh interval, scanner 418, rate limits, feed-hit reporting, schema hosts and sensor hosts are all [vars]. Defaults match 2.4.0, so an existing deployment behaves the same. Observe mode blocks nothing and records everything it would have blocked: a Workers Logs line, an X-DugganUSA-Observed response header, and an observed feed-hit report. Run it for a week before you block. Sensor hosts are passed through untouched. The feed is now pulled once per data center, not once per isolate.
What's New in 2.4.0
NetScaler ADC / Gateway canaries. CVE-2026-88771 and CVE-2026-88772 were exploited for weeks before disclosure. Our own honeypots logged 126,873 attack records and not one of them was a NetScaler probe, because nothing we ran looked like a NetScaler. The Worker now answers the paths NetScaler scanners fingerprint first, tags each catch citrix-netscaler, and is off by default on customer zones (see Privacy). Known limit: CVE-2026-88772 is reached over DTLS (UDP), which an HTTP Worker never sees.
What's New in 2.3.0
This Worker now closes the loop on feed liveness. When one of our published indicators blocks real traffic at your edge, the Worker reports the hit back to the feed-efficacy axis — privacy-preserving (it sends only the indicator we already published, never your visitors or assets). That turns "we have 653,342 distinct IOCs" into "here's proof they fire in the wild."
Don't take our word for the feed — verify it yourself. The DugganUSA platform serves four live, no-auth, durable validation endpoints (durable across our deploys; each response carries a source field of live, durable, or baseline):
- Novelty —
/api/v1/feed-uniqueness: how much of our independently sourced data is not already in ThreatFox, so you can see what this feed adds beside the feeds you already run.
- Timeliness —
/api/v1/kev-lead: a live ledger of when each exploited CVE entered our corpus next to its CISA KEV listing date, with receipts, including the ones we had no record of.
- Accuracy —
/api/v1/spamhaus-validation: Spamhaus independently corroborates our first-hand contributions.
- Liveness —
/api/v1/feed-efficacy: opt-in consumer reports of when our indicators actually fire on real traffic — proof the feed is operationally live, not just large. This Worker is a reporter for that axis.
Feed depth also grew with OSV malicious-package feeds (npm + PyPI) and daily GitHub Hunt detections, alongside 15 external feed sources.
Note: the STIX feed is API-key-enforced. The Worker already requires a registered key (wrangler secret put DUGGANUSA_API_KEY); anonymous pulls return 401. The free tier is a free registered key — register here.
What It Does
Visitor → Cloudflare Edge → Edge Shield → Your Origin
│
├── Scanner? → 418 "We see you. We indexed you."
├── Known IOC? → 403 Blocked
└── Clean? → ✅ Pass with geo headers
| Layer | What Happens | Latency Added |
|---|
| Scanner Detection | Returns 418 to Shodan, Censys, LeakIX, Nuclei, ZMap | 0ms |
| IOC Blocking | Blocks IPs from the DugganUSA feed (live counts) | 0ms (cached) |
| Geo Enrichment | Adds city, region, ASN, lat/lon headers to every request | 0ms |
Zero external lookups. Zero latency added. The intelligence lives in Worker memory.
Quick Start (by hand)
git clone https://github.com/pduggusa/dugganusa-edge-shield.git
cd dugganusa-edge-shield
cp wrangler.example.toml wrangler.local.toml # set your routes + [vars]
npx wrangler secret put DUGGANUSA_API_KEY -c wrangler.local.toml # Free: analytics.dugganusa.com/stix/register
npx wrangler deploy --dry-run -c wrangler.local.toml
npx wrangler deploy -c wrangler.local.toml
scripts/verify.sh --product www.yourdomain.com --mode observe
wrangler.toml is DugganUSA's own deployment. Don't deploy it; use your wrangler.local.toml (gitignored).
That's it. Your site is protected by the DugganUSA feed — plus behavioral blocking, which is the half a list cannot do.
What Your Origin Server Receives
Every request gets enriched headers — for free:
X-CF-City: Minneapolis
X-CF-Region: Minnesota
X-CF-Country: US
X-CF-ASN-Org: Comcast Cable Communications
X-CF-Latitude: 44.9778
X-CF-Longitude: -93.2650
X-DugganUSA-Shield: active
X-DugganUSA-IOCs: 1100000
Build geo dashboards, detect anomalies, log city-level analytics — all from headers your origin already receives.
x-dugganusa-edge (2.14.0) is DugganUSA-only. You don't need it. DugganUSA's own deployment sends it to DugganUSA's own origin so that origin can tell a request really came through the edge before it believes cf-connecting-ip. It is sent only when the ORIGIN_EDGE_SECRET secret is set and only to the hosts in ORIGIN_EDGE_HOSTS (default analytics.dugganusa.com), so a customer deployment sends nothing. Leave both unset. Any copy of the header a client sends is stripped before your origin sees it. If you want the same protection for your own origin, set both on your own Worker, compare the value in constant time at the origin, and only then trust cf-connecting-ip.
What Scanners See
{
"message": "We see you. We indexed you.",
"your_ip": "68.183.9.16",
"your_asn": "AS14061",
"your_org": "DigitalOcean, LLC",
"your_city": "Amsterdam",
"protected_by": "DugganUSA Edge Shield",
"score": "You scored 0/95 on our scanner detection. Congratulations."
}
HTTP 418 I'm a Teapot.
The Intelligence Behind It
Edge Shield enforces the DugganUSA Feed (STIX 2.1):
| Metric | Value |
|---|
| IOC records indexed | live: /api/v1/search/stats (records are point observations, not distinct indicators) |
Alongside the external feeds, we hunt: 18 documented supply chain attacks (Pattern 38). NrodeCodeRAT found through behavior. IRGC target analysis on 18 US tech companies. FBI wiretap breach analysis published same-day.
Fix Your AI Visibility — AIPM
Is your brand invisible to ChatGPT?
We built AIPM (AI Presence Management), a tool that audits how AI models perceive your brand. Five models. Seven signals. Free.
We used it on ourselves. 0% → 23% ChatGPT visibility in 3 days. Here's what we did:
On our own numbers. This README previously claimed "275+ consumers in 46 countries" and
that Microsoft, AT&T, Meta and Zscaler "already pull our feed." Both were removed in August
2026 because both were wrong. The consumer figure counted one-off curious pulls, not
operational consumers, and we retired it publicly. The named-company claim came from our own
feed analytics reporting top ASNs without splitting by status code — 97.5% of that traffic
was HTTP 403 to UA-less scrapers being correctly blocked. We were reading our own doormat
as a customer list. The indicator count was also a record count, inflated roughly 2.6x
against distinct indicators. If you are going to publish an honesty axis on a feed, the
README is part of the feed.
- robots.txt — invited AI crawlers explicitly (GPTBot, ClaudeBot, PerplexityBot)
- LD-JSON — added Organization, Product, FAQ schema across all properties
- llms.txt — deployed an AI-readable site summary
- NLWeb — built a Cloudflare Worker that serves
/.well-known/nlweb for AI content retrieval
- Managed questions — told the AI models what questions to answer about us
- Content velocity — 15 blog posts in 4 days naming specific companies and CVEs
AIPM scores all of this. Run your audit. See your gaps. Fix them.
We went from "motorcycle oil company" (what GPT-4o thought we were) to accurate threat intelligence descriptions across 4 of 5 models. The structured data + content velocity + GEO optimization stack works. AIPM measures it.
Audit Your Brand Free →
Scores llms.txt and NLWeb alongside what the models say.
Pricing
The Worker is free and open source forever. The intelligence is tiered:
| Tier | Price |
|---|
| Free | $0, 10 queries/day |
| Shield | $24/mo |
| Pro | $99/mo or $948/yr |
| Enterprise | $995/mo or $9,950/yr |
Current limits and prices: analytics.dugganusa.com/pricing.
Get Your Free API Key →
Reading Geo Headers
// Node.js / Express
app.use((req, res, next) => {
const city = req.headers['x-cf-city'];
const region = req.headers['x-cf-region'];
const org = req.headers['x-cf-asn-org'];
console.log(`${city}, ${region} — ${org}`);
next();
});
# Python / Flask
@app.before_request
def log_geo():
city = request.headers.get('X-CF-City', 'Unknown')
region = request.headers.get('X-CF-Region', 'Unknown')
print(f"{city}, {region}")
Privacy — read this before deploying
The Worker runs on YOUR Cloudflare account. We provide the intelligence. But two
features do send data back to us, and you should decide about them deliberately.
Normal traffic: we see nothing
For ordinary requests — including requests we block from the IOC feed — we receive
only:
- API key usage (query count per day)
- Which IOC lists you pull
No visitor data. No request URLs. No origin details.
Honeypot canaries: we receive visitor data (Layer 3)
Edge Shield includes decoy paths (.env, /wp-login.php, /webmail, and others).
When a request hits one, indexHoneypotHit() sends us:
- the visitor's IP address
- the full User-Agent
- city, region, country, ASN and ASN organisation
- the full request URL, HTTP method, TLS version and Cloudflare bot score
- since 2.22.0, a reading of what the request carried: which attack-shaped markers
matched the URL or the body (
traversal, sqli, jndi, command-injection and similar),
the body's length and content type, and the names of submitted form or JSON fields
What 2.22.0 does NOT send, by design. Field values are never recorded. If a request
posts password=hunter2, we keep the fact that a field called password was present and
throw the value away — the same line the existing default_creds boolean already drew. The
raw body is not stored at all unless an operator sets CANARY_BODY_SAMPLE = "true", which is
off by default; even then the sample is capped at 512 bytes and credential-shaped values are
replaced with [redacted] before it leaves the edge.
Why we added it: a 30-day census of 25,915 canary hits found 4,973 POSTs with no body ever
captured and an exploit marker that had fired once, because it only ever read the path. We
could tell you someone knocked, not whether they were reading a list of doors or carrying a
working key. Those are different threats and only one of them is worth waking up for.
That is visitor data and site data. An earlier version of this README stated we
see none of it. That was wrong — the code always sent it. We corrected the
document rather than quietly changing the behavior, because customers made
deployment decisions against the old text.
If you operate in the EU or handle personal data: an IP address plus
User-Agent plus geolocation is personal data under GDPR, and this is a transfer to
a third party. Get a DPA in place or disable the feature before deploying.
To disable honeypots entirely, set HONEYPOTS_ENABLED = "false" in your
wrangler.local.toml vars. IOC blocking is unaffected.
NetScaler appliance canaries (2.4.0) are OFF on your zones by default. They
answer NetScaler Gateway login paths (/vpn/, /logon/LogonPoint/, /cgi/login,
/nf/auth/ and similar) with a decoy, which would break a real NetScaler behind
the same zone. They run by default only on DugganUSA's own zones. Set
APPLIANCE_CANARIES = "true" to opt in; "false" turns them off everywhere.
Feed hit reporting
Controlled by FEED_HIT_REPORTING (on unless you set it to "false"; the example
config ships it off so you decide). If enabled, we receive the indicator that
matched, the action (blocked, or observed in observe mode), a count and the
Cloudflare ray ID, plus a hash of your API key — never your visitor's identity. One caveat: when a match comes from a CIDR range
(ASN prefixes, /24 blocks), the reported IP may be an address we never published
individually. It is still an address that matched a range you chose to block.
Canary paths may collide with your real routes
The decoy list was written for our own infrastructure. Paths like /graphql,
/webmail/*, and anything containing .env will return deception content
instead of your real response, and the requesting IP will be reported to us as a
scanner. If you serve any of those paths legitimately, disable honeypots or edit
CANARY_PATHS before deploying.
Since 2.21.0 a canary path also takes precedence over the scanner 418 and the IOC
403: a request to a trapped path is decoyed rather than blocked, even from a known
scanner or a listed IP. The feed hit is still reported, and the secret-file probe
handler still answers first. This matters for collisions — if a canary path overlaps one
of your real routes, a visitor you would otherwise have blocked now receives deception
content instead. One more reason to check the list against your routes before enabling
honeypots.
Also From DugganUSA
| Product | What It Does |
|---|
| DugganUSA Feed | Threat-intel feed: STIX/TAXII, CSV, MISP |
| Jeevesus | Search MCP over the corpus |
| Dredd | Pre-flight verdict on MCP servers and their dependency trees |
| AIPM | AI Presence Management: what AIs say about you |
| FinOps | Enterprise Metering: what AI agents and API calls actually cost |
| Research | Threat intelligence research with receipts |
DugganUSA LLC — Minnesota • v2.5.0
Threat intelligence you can check. Built with Claude. Contact: [email protected]
D-U-N-S: 14-363-3562 • SAM.gov UEI: TP9FY7262K87
"The boring architecture is the safe architecture."
dugganusa.com • aipmsec.com • Bluesky
DugganUSA Defender Family
Same DugganUSA Feed, surfaced wherever you live. Open source, MIT licensed, receipts on every repo.
Backed by the DugganUSA Feed. Numbers are live: /api/v1/search/stats. Pricing: analytics.dugganusa.com/pricing. Contact: [email protected].
Threat intelligence you can check.
