Berlin Called
- Patrick Duggan
- Mar 8
- 5 min read
# Berlin Called
On Friday night, we published an investigation into Nicole Junkermann — the woman with 3,076 DOJ documents, zero congressional subpoenas, and a CARVER score higher than Bill Clinton, Donald Trump, and Prince Andrew combined.
By 9 PM, two IP addresses in Berlin were scraping our search engine.
The Scrape
March 7, 2026. Between 20:52 and 22:46 UTC.
Two IPs — 104.23.199.62 and 104.23.199.63 — sent 884 requests to our Meilisearch index. No user agent. No referrer. No browser. Just raw POST requests to `/indexes/epstein_files/search`.
The pattern was textbook:
First, small probes. 145-byte responses. Testing what comes back. Enumerating the schema.
Then the escalation:
- 259,955 bytes in a single response
- 184,514 bytes
- 635,313 bytes
- **2,503,617 bytes** — two and a half megabytes in one pull
Total extraction: **82.8 megabytes** across 884 requests.
Someone was building a local copy of our index. Or at least trying to.
Berlin
Both IPs geolocate to Berlin, Germany. Postal code 10119. Cloudflare edge nodes, so the real source is proxied — but the Cloudflare POP tells us where the request originated.
Berlin.
The city where Nicole Junkermann's lawyers have obtained **five or more interim court injunctions** against journalist Johnny Vedmore. The city where articles about her Epstein connections are geo-blocked. The city from which Substack was pressured to remove four articles about her in October 2025.
We published a 3,076-document investigation into Junkermann at approximately 6 PM Central. Three hours later, Berlin started downloading our database.
The Cipher Predicted Her
Here's the part that makes this story worth telling.
We didn't find Junkermann by accident. We predicted her.
In February 2026, we built a methodology called the **zero-document cipher**. The thesis: when someone who should appear in government documents appears in zero, the absence itself is the signal. Selective redaction creates identifiable holes. The pattern of what's missing tells you what matters.
We scored individuals on a 0-30 scale based on their predicted appearance in DOJ documents. Seven predictions. Seven validated. Spearman correlation of 0.319 — a moderate positive signal from a method nobody had tried before.
Nicole Junkermann was one of the zeros. Zero appearances in the initial 136,000 DOJ pages. Two BVI shell companies in the Panama Papers. NHS Digital health data access. Photographic evidence with Epstein dating to 2002. Flight logs. Corporate board overlap with Carbyne — the 911 technology company Epstein funded, Ehud Barak chaired, and Peter Thiel invested in.
Everything pointed to a large document footprint. The documents said zero.
Then the full DOJ release came. The pagination bug got fixed. The corrected count: **3,076 documents**.
The biggest single correction in our entire 155-target CARVER matrix. From 19/30 to 28/30. Higher than every person Congress investigated.
The cipher called it. The data confirmed it. And Berlin confirmed the data matters.
What They Were Looking For
We don't know who sent the scraper. Could be her lawyers conducting opposition research. Could be a journalist in Germany trying to access information that's geo-blocked in their country. Could be a security researcher. Could be someone building a competing product.
What we know:
1. They hit our Meilisearch endpoint directly — not through our website
2. They sent no user agent and no referrer — deliberate anonymization
3. They escalated from small probes to bulk extraction — systematic, not casual
4. They did it within hours of our Junkermann investigation going live
5. They're in Berlin
We're not making accusations. We're stating what the logs show. The logs are timestamped, the IPs are geolocated, and the request pattern is unambiguous.
The Fix
As of March 8, 2026, the endpoint is hardened:
- Empty user agents are blocked (403)
- Requests without a valid referrer from our domain are blocked (403)
- Rate limiting: 10 requests per second with burst tolerance
- CORS locked to `epstein.dugganusa.com` (was `*` — open to any origin)
The search engine is still free. The data is still public. Any human can search 398,560 DOJ documents without an account.
But bulk extraction by anonymous scrapers? That's over.
You want the data? Use the search bar like everyone else. Or register for an API key — they're free. We just want to know who's asking.
The Lawfare Pattern
This is the same pattern, applied digitally.
Nicole Junkermann's documented response to public-interest journalism:
1. **Court injunctions** — 5+ via Berlin courts against Johnny Vedmore
2. **Platform pressure** — Substack removed 4 articles (later restored)
3. **Geo-blocking** — Articles suppressed in Germany
4. **Content suppression** — Near-zero social footprint (21 Instagram followers)
The pattern works against individual journalists. Vedmore is one person. Substack is one platform. A German court order reaches German ISPs.
It doesn't work against a search engine in Minneapolis running on a Minnesota LLC with:
- **First Amendment** protection
- **Minnesota shield law** (journalist source protection)
- **Anti-SLAPP statute** (protection against frivolous lawsuits designed to silence)
- **No German court jurisdiction**
Berlin can issue all the injunctions it wants. The documents are indexed. The search engine is live. The blog post is published. And we just closed the back door they were using to quietly download it all.
What the Cipher Teaches
The zero-document cipher works because powerful people leave predictable patterns when they try to disappear from public records.
The same logic applies to web traffic. When someone scrapes your database anonymously three hours after you publish, they're telling you the publication matters. The scrape is the signal.
If the investigation didn't matter, nobody would have scraped it.
If the data wasn't valuable, nobody would have tried to bulk-extract it.
If the search engine wasn't a threat, nobody in Berlin would have noticed it existed on a Friday night.
The absence is the signal. The scrape is the confirmation. The cipher works in both directions.
The Numbers
| Metric | Value |
|--------|-------|
| DOJ documents mentioning Junkermann | 3,076 |
| Congressional subpoenas for Junkermann | 0 |
| CARVER score | 28/30 |
| Berlin court injunctions | 5+ |
| Hours between publication and scrape | ~3 |
| Scraper requests | 884 |
| Data extracted | 82.8 MB |
| User agent provided | None |
| Referrer provided | None |
| Time to close the vulnerability | 14 hours |
*The cipher predicted her. The documents confirmed her. Berlin tried to download the evidence. We shut the door.*
*The search engine is free. The data is public. The back door is closed.*
**Search the files yourself:** [epstein.dugganusa.com](https://epstein.dugganusa.com)
*DugganUSA LLC — Minneapolis, MN. One name on the line, no hiding behind a foundation.*
*Free STIX/TAXII Feed: [analytics.dugganusa.com](https://analytics.dugganusa.com)*
*Epstein Files Search: [epstein.dugganusa.com](https://epstein.dugganusa.com)*
*Support the mission: [epstein.dugganusa.com/donate](https://epstein.dugganusa.com/donate)*
*Sources: DugganUSA server logs (nginx access.log, March 7-8, 2026), IPinfo.io geolocation (AS13335 Cloudflare Berlin POP), DugganUSA CARVER matrix (155 targets, March 7 rescore), U.S. Department of Justice Epstein File Releases (Datasets 9-11), ICIJ Offshore Leaks Database (Panama Papers), Calcalist (Vedmore injunctions), Substack content removal record (October 2025).*
*Her name was Renee Nicole Good.*
*His name was Alex Jeffery Pretti.*
Comments