How I Deployed Multi-Source Threat Intelligence on $9.88 of Chicken Sandwiches (And Why That Matters for Founders)

# How I Deployed Multi-Source Threat Intelligence on $9.88 of Chicken Sandwiches (And Why That Matters for Founders)

**Author:** Patrick Duggan

**Reading Time:** 8 minutes

**Category:** Infrastructure, Cost Optimization, Agentic AI

---

The Setup

Enterprises spend $155/month on development VMs and $18 on DoorDash lunch. I spent $46/month on a MacBook Air M3 and $9.18 on three homemade chicken sandwiches (cottage loaf, toasted, with cheese). Then I deployed VirusTotal, AbuseIPDB, and ThreatFox integration to a production analytics dashboard in 3 hours.

This isn't a blog post about sandwiches. This is evidence that **Butterbot by DugganUSA** works - an agentic agent that eats failures and shits excellence. And it's proof that the cost models everyone accepts as "normal" are bullshit.

---

The Problem: "Liar Dashboard"

Yesterday at 7:36 PM, I opened my analytics dashboard at `https://analytics.dugganusa.com/` and saw 2 red dots on the map. TWO. Meanwhile, Cloudflare's analytics showed 21,850 requests from 49 countries - Korea (833 requests), Singapore (787), Netherlands (734), Canada (692).

I called it a "liar dashboard." My buddy (dream partner for this venture) would've called it worse.

**Root Cause:** The dashboard was reading static JSON files that existed on my MacBook but not in the Docker container. Classic developer mistake - works on my machine, breaks in production.

**Traditional Fix:** Spin up an Azure dev VM ($155/month), replicate the issue, debug in "production-like environment," deploy fix, hope nothing else breaks.

**My Fix:** Three chicken sandwiches, Claude Code 2.0.27, and a willingness to admit "I fucked up the container build."

---

The Session: What Actually Happened

**Duration:** 3 hours (including sandwich-making time)

**Cost:** $9.88 total

**Breakdown:**

- Cottage loaf bread: $0.56/sandwich

- Chicken breast: $1.75/sandwich

- Cheese: $0.50/sandwich

- **Codiments** (Mayo + Sweet Baby Ray's + Buffalo Ranch squirt): $0.25/sandwich

- MacBook Air M3 electricity: $0.05 (15W × 3 hours × $0.148/kWh)

- Claude Code subscription: $0.65 (prorated 3 hours of $20/month)

**What We Built:**

1. **Replaced Static Files with Live Cloudflare GraphQL API**

- Before: Reading `cloudflare-analytics-2025-10-24.json` (didn't exist in container)

- After: Querying `httpRequests1dGroups` dataset (24-hour window, Free plan compatible)

- Result: 27 countries showing live data

2. **Integrated 3 Threat Intelligence APIs**

- **VirusTotal:** IP reputation (malicious/suspicious detections)

- **AbuseIPDB:** Abuse confidence scores (0-100%)

- **ThreatFox:** C2/Malware IOC detection

- Cache: 24 hours per IP (rate limit protection)

3. **Fixed the Popup Timing Bug**

- Problem: `document.getElementById()` called before popup was in DOM

- Solution: Wrapped fetch in `marker.on('popupopen')` event handler

- Result: Threat intel data loads when you CLICK a marker, not before

4. **Deployed to Production**

- Docker buildx (ARM → AMD64 cross-compile)

- Azure Container Apps (`analytics-dashboard--threatintel-1761427978`)

- New revision live at `https://analytics.dugganusa.com/`

**All while eating sandwiches.**

---

The Cost Model: Why This Matters

**My Session:**

- Sandwiches: $9.18

- Electricity: $0.05

- Claude Code: $0.65

- **Total: $9.88**

**Equivalent Enterprise Session:**

- Azure dev VM (3 hours): $15.50

- DoorDash lunch: $18.00 (delivery + fees + tip)

- Claude Code: $0.65

- **Total: $34.15**

**Savings: $24.27 per session (71% cheaper)**

But that's just one session. The real savings are structural:

**Infrastructure Annual Costs:**

| Component | Enterprise | DugganUSA | Savings |

|-----------|-----------|-----------|---------|

| Dev Environment | $1,860/year (VM) | $552/year (MacBook amortized) | $1,308 |

| Staging Environment | $1,860/year (VM) | $0 (use local) | $1,860 |

| Production | $1,860/year (VM) | $180/year (Container App) | $1,680 |

| **Total per Service** | **$5,580/year** | **$732/year** | **$4,848/year** |

**With 10 microservices: $48,480/year saved.**

---

The Pattern: ARM → AMD64 Cost Arbitrage

**Why This Works:**

1. **Apple Silicon for Development**

- M3 MacBook Air: 15W power consumption

- 24GB RAM (more than most dev VMs)

- Cost: $1,599 one-time (amortized to $46/month over 36 months)

2. **Docker Buildx for Cross-Compilation**

- Build on ARM (MacBook)

- Deploy to AMD64 (Azure Container Apps)

- Command: `docker buildx build --platform linux/amd64`

3. **Azure Container Apps for Production**

- $15-20/month per microservice

- No VM management overhead

- Auto-scaling (0 to N replicas)

**Crown Jewel Patent:** "ARM-to-AMD64 Cross-Platform Development Cost Arbitrage"

Traditional enterprises pay for:

- Dev VM (can't use local because "not production-like")

- Staging VM (can't use dev because "not production")

- Production VM (can't use staging because "not final")

I pay for:

- MacBook (already own it)

- Electricity (15W vs 200W VM equivalent)

- Production Container Apps (only thing that needs to be always-on)

**87% cost reduction.**

---

The Codiment Architecture (Yes, Really)

Here's where it gets absurd (Pattern #18: Creative Monetization via Absurdist Confidence).

**My Sandwich Layers:**

1. **Mayo** - Base layer (stability, richness)

2. **Sweet Baby Ray's BBQ Sauce** - Middleware (complexity, depth)

3. **Buffalo Ranch** - Top layer squirt (heat, acceleration)

**My Code Architecture:**

1. **Express.js session middleware** - Base layer (authentication, cookie security)

2. **Multi-source API correlation** - Middleware (Cloudflare + GA4 + Wix + Threat Intel)

3. **Threat intel enrichment** - Top layer (VirusTotal + AbuseIPDB + ThreatFox popup data)

I'm not saying this is a coincidence. I'm saying **if you can't explain your architecture in sandwich condiments, you don't understand your architecture.**

**Gets Artists Paid:**

- Mayo: Hellmann's (~$5/jar)

- BBQ Sauce: Sweet Baby Ray's (~$3/bottle)

- Buffalo Ranch: Ken's Steakhouse (~$4/bottle)

Total condiment cost: $0.25/sandwich for three distinct flavor layers. Enterprise equivalent: $0.50/sandwich for single-packet mediocrity from DoorDash.

---

The Product Proof: Butterbot by DugganUSA

This session wasn't just about fixing a dashboard. It was about proving that **agentic AI can eat failures and shit excellence.**

**What Butterbot Did:**

1. **Diagnosed the Problem**

- User: "liar dashboard"

- Butterbot: Searched logs, found MODULE_NOT_FOUND errors, identified static file dependency

2. **Proposed the Solution**

- Replace static JSON files with live Cloudflare GraphQL API

- Integrate threat intelligence APIs (VirusTotal, AbuseIPDB, ThreatFox)

- Fix popup timing bug (DOM ready state)

3. **Implemented the Fix**

- 420 lines of code changes

- Docker build + push + Azure deployment

- All while I ate sandwiches and commented on the codiments

4. **Learned from the Failure**

- Docker Dependency Resilience Law documented

- Testing checklist updated (build → test locally → verify health → THEN deploy)

- Pattern added to compliance evidence

**This is the product.** An AI partner that:

- Doesn't need coffee breaks

- Doesn't get defensive when you call its output "liar dashboard"

- Documents every decision for audit trails

- Costs $20/month (not $150K/year consultant)

---

Why This Matters for Founders

**My buddy (dream partner) and I are building this for you.**

Not for enterprises with $5M budgets and 50-person DevOps teams. For founders who are:

- Bleeding money on AWS/Azure/GCP

- Hiring consultants at $200/hour to fix shit that shouldn't be broken

- Outsourcing everything because "not our core competency"

- Wondering why their infrastructure costs more than their product revenue

**The DugganUSA Thesis:**

1. **Own the layers that matter**

- Your hardware (MacBook, not rented VMs)

- Your food (homemade, not DoorDash)

- Your core IP (threat intel correlation, not off-the-shelf SIEM)

2. **Rent only commodity compute**

- Azure Container Apps ($15/month)

- Cloudflare Free Plan (CDN + WAF + Analytics)

- Free-tier APIs (VirusTotal, AbuseIPDB, ThreatFox)

3. **Use AI that learns YOUR voice**

- Butterbot analyzes blog post engagement (Wix + GA4)

- Learns what resonates (personal stories > abstract philosophy)

- Tunes output to match your patterns

- **Costs $20/month, not $150K/year**

**The Math:**

- Enterprise: $5,580/year per microservice × 10 services = $55,800/year

- DugganUSA: $732/year per microservice × 10 services = $7,320/year

- **Savings: $48,480/year (87% cost reduction)**

**The Pitch:**

You can keep renting everything and hoping the bills go down (they won't). Or you can buy a MacBook, learn to make sandwiches, and deploy threat intelligence on cottage loaf.

One of those options makes you dependent on vendors. The other makes you dangerous.

---

The Technical Details (For Founders Who Code)

**Cloudflare GraphQL API Integration:**

**Why This Matters:**

- Free plan limit: 24 hours (not 7 days)

- Parameter: `date` (not `datetime_geq`/`datetime_leq`)

- Dataset: `httpRequests1dGroups` (not REST API)

**I spent 2 hours debugging this because I didn't RTFM.** Butterbot reminded me to read the Cloudflare docs. Cost of hubris: 2 hours. Cost of reading docs first: 5 minutes.

---

**Threat Intel Popup Fix:**

**Why This Matters:**

- `document.getElementById()` returns null if element not in DOM

- Popups aren't in DOM until user clicks marker

- Async fetches need to wait for DOM ready state

**Lesson:** Timing bugs are harder to debug than logic bugs. Test with real user interactions, not just unit tests.

---

The Bottom Line

I deployed multi-source threat intelligence (VirusTotal + AbuseIPDB + ThreatFox) on $9.88 of chicken sandwiches (cottage loaf, mayo, Sweet Baby Ray's, buffalo ranch squirt).

Enterprises spend $34.15 per development session and $55,800/year on infrastructure for 10 microservices.

I spend $9.88 per session and $7,320/year on infrastructure.

**The difference: 87% cost reduction through vertical integration.**

But the real difference is philosophy:

- **Enterprises rent everything** (VMs, lunch, DevOps, AI)

- **I own what matters** (MacBook, sandwiches, core IP, Butterbot)

**For founders: Which model gets you to profitability faster?**

---

What's Next

My buddy (dream partner) and I are building **Butterbot by DugganUSA** - an agentic AI that eats failures and shits excellence. It's not ready for customers yet (we're still eating our own dog food), but when it is, you'll be able to:

- Deploy infrastructure on MacBooks (not rented VMs)

- Learn from analytics automatically (Wix + GA4 + Cloudflare correlation)

- Get threat intelligence enrichment (VirusTotal + AbuseIPDB + ThreatFox)

- Pay $20/month (not $150K/year for consultants)

**If you're a founder bleeding money on cloud bills, we're building this for you.**

In the meantime: Buy a MacBook. Learn to make sandwiches. Read the fucking manual. Deploy something that matters.

**And when someone calls your dashboard a liar, fix it on cottage loaf.**

---

**Want to see the dashboard?** https://analytics.dugganusa.com/

**Want to hire me?** [email protected]

**Want to learn more about Butterbot?** https://www.dugganusa.com/

---

**P.S.** - The sandwiches were really good. The threat intelligence integration was better. But the real win was proving that you don't need enterprise budgets to build enterprise-grade infrastructure.

**You just need to own what matters and rent the rest.**

🍗 + 💻 = 🎯

---

*This post was written with Butterbot by DugganUSA. Total time: 45 minutes. Total cost: $0.65 (prorated Claude Code subscription). Sandwiches not included.*