30+ days ahead of CISA KEV.
From $0/mo.
Catch threats before the federal mandate. May 2026 average lead: 31 days across 6 receipts. Free STIX 2.1 threat feed. Precursor signals 1-5 hours early. See the methodology →
Not just copied lists. In our latest check, 455 of 455 sampled indicators were not in ThreatFox (our lookup finds about 3 in 4 of ThreatFox's own entries, so a few overlaps can hide). Our honeypot indicators blocked traffic 13,114 times in the last 30 days. Numbers update live. Sources: feed uniqueness, feed efficacy.
What you get beyond a list
- A score on every item. 99.9% of our 1.96 million indicators have a confidence score. You pick how strict to be.
- The why. About half (51%) say which malware family is behind them.
- Where it came from. Every item names its source. We credit other people's lists by name.
- Plain-English reports. We write up the campaigns behind the data, so a person can understand it.
- Fixes when we're wrong. Tell us and we check it. If it's wrong, we take it out for everyone.
Counts as of Oct 2026.
“A live production platform processing real threats in real time, 275 organizations pulling your STIX feed across 46 countries, US Navy and Australian critical infrastructure as registered users, SAM.gov federal registration, and two validated breach predictions before public disclosure — that’s a level of demonstrated capability that most early-stage security companies spend years and millions of dollars trying to establish.”
- All indexes searchable
- VS Code, Chrome, CLI, Obsidian plugins
- Community documentation
- No promises; email help, best effort
- Everything in Free
- Edge Shield on hourly refresh (a handful of Cloudflare data centers)
- Month-to-month, cancel anytime
- Best-effort email support
- Everything in Free
- Search every index
- Integration docs
- Tor relay & attribution API access
- OPNsense/Suricata feeds
- Best-effort email support
- Everything in Pro
- More volume for big or many sites
- Enterprise analytics endpoints
- Behavioral intelligence API
- NET-30 invoicing available
- Best-effort email support
DugganUSA Edge Shield
Open-source Cloudflare Worker for edge-level threat blocking. Pairs with the STIX feed so you can block malicious IPs at your edge before they reach your infrastructure. Point Claude Code at the repo and it walks you through setup, observe mode first. View on GitHub →
What each tier runs: every refresh is 2 calls (IPs + domains) per Cloudflare data center. A free key (10/day) fits a small site on a daily refresh (IOC_REFRESH_MINUTES=1440) in one or two data centers. The default hourly refresh costs at least 48 calls per data center per day, and more when the worker restarts — that is Shield ($24/mo, 300/day) for a handful of data centers, or Pro (2,000/day) beyond that. On free with hourly refresh the key runs dry in the early hours UTC and the shield keeps blocking on the last list it pulled. Watch Workers Logs for IOC refresh FAILED.
Feature Comparison
| Feature | Free | Shield | Pro | Enterprise |
|---|---|---|---|---|
| Daily Queries | 10 | 300 | 2,000 | 50,000 |
| Edge Shield Refresh | Daily | Hourly (a few data centers) | Hourly | Hourly |
| All Indexes Searchable | ✓ | ✓ | ✓ | ✓ |
| VS Code / Chrome / CLI / Obsidian Plugins | ✓ | ✓ | ✓ | ✓ |
| Community Documentation | ✓ | ✓ | ✓ | ✓ |
| Integration Docs | — | — | ✓ | ✓ |
| Tor Relay & Attribution API | — | — | ✓ | ✓ |
| OPNsense / Suricata Feeds | — | — | ✓ | ✓ |
| Behavioral Intelligence API | — | — | — | ✓ |
| Support | Best-effort email | Best-effort email | Best-effort email | Best-effort email |
| Response-time guarantee | None | None | None | None |
| Price | $0/mo | $24/mo month-to-month | $99/mo month-to-month ($948/yr if paid annually) | $995/mo ($9,950/yr) |
Payment
Stripe Checkout (Shield, Pro)
Card, Link, Cash App, Klarna, Affirm, ACH. Instant activation.
Cancel anytime. Annual billing saves 20%.
Frequently Asked Questions
How is this different from Recorded Future or ThreatConnect?
Recorded Future starts at $10,000/year per seat. ThreatConnect starts at $18,000/year. CrowdStrike Falcon Intelligence is $25,000+/year. Anomali ThreatStream quotes $50,000+/year for enterprise. Mandiant Advantage requires a sales conversation and six-figure contracts.
DugganUSA Pro is $99/month, or $948/year paid annually. For 2,000 queries/day across ~293K published IOCs, 26.1M Tor relay snapshots, 403 adversary profiles, and 68 indexes. With 12 integrations that work in your editor, your browser, your Slack, your SIEM. No seat licensing. No per-endpoint pricing. No sales call required.
We also publish original research the big vendors don't have: Tor infrastructure attribution with operator clustering, domain staging detection that caught ShinyHunters infrastructure 7 months pre-breach, C2 infrastructure monitoring that found The Gentlemen's victim-named subdomains before any vendor report. Behavioral scoring from live honeypots, not aggregated third-party reports. 10-signal precursor system with 1–12 month lead time.
Who decides what gets blocked?
You do. We send data. We do not block anything for you. Your firewall, DNS filter or SIEM pulls the data and uses your rules. You pick how sure a score must be with min_confidence. For example, our own edge uses 80. ips.csv starts at min_confidence=50. domains.csv and hashes.csv do not filter by score unless you ask.
What if an indicator is wrong?
Email [email protected] with the indicator. We will check it. If it is wrong, we take it out of the feed for everyone. We try to be quick, but we can’t promise a time.
Who uses it?
Pulled daily by production CTI integrations — MISP, OpenCTI, SIEM connectors and firewall blocklists. We do not name who consumes the feed.
What does the free tier include?
10 queries/day across all indexes. VS Code, Chrome, CLI, and Obsidian plugins included. Community documentation. No commitments, but enough to evaluate everything we offer.
What is the RESCUEME coupon?
Use code RESCUEME at checkout for 40% off your first month of Pro. That's $59.40 instead of $99 to get started with 2,000 queries/day.
Existing free consumers?
All existing free accounts keep free access. Founding customers: email [email protected] for special pricing.
~293K published IOCs · ~653K distinct held · free tier · 26.1M Tor relay snapshots