Saturday Night and Meta Is Our Distributor
- Patrick Duggan
- Mar 14
- 4 min read
Updated: Apr 25
# Saturday Night and Meta Is Our Distributor
**Author:** Patrick Duggan (with Claude Code)
**Series:** DugganUSA Field Reports
10 PM on a Saturday
Five Facebook crawlers are hitting our infrastructure right now. Five different IPv6 addresses in Meta's `2a03:2880:f802` block, fetching link previews from different shares. Someone — multiple someones — are posting links to our Epstein search engine on Facebook, Instagram, WhatsApp, or Threads.
We didn't ask them to. We didn't pay for it. We didn't even know until we looked at the Cloudflare logs.
Meta — the company that reaches 3.5 billion humans — is distributing our content for free because people can't stop sharing what they find in the files.
What Happened Today
At 7 AM this morning, we ran a traffic report. ChatGPT was our #1 social referral channel with 520 sessions. We indexed 23 threat indicators from a Chinese military espionage campaign. We shipped 16 software deployments. We wrote a blog post about Pi Day.
At 3 PM, a Detection Engineer at a $7B healthcare company emailed us. He'd spent 4-5 hours trying to integrate our STIX threat intelligence feed into his Splunk SIEM. It kept returning 403 Forbidden.
The problem: his company routes traffic through Zscaler's cloud proxy. Our platform detected Zscaler's IP range and classified the request as a competitor — because Zscaler IS a competitor. They sell threat intelligence. We rate-limit competing vendors.
But Juan isn't Zscaler. He's a customer who sits behind Zscaler. His API key was valid. His configuration was correct. We were blocking our own customer because we couldn't tell the difference between the proxy and the person.
We shipped two fixes within hours. One at the application layer — authenticated requests now bypass competitor detection. One at the Cloudflare edge — an explicit allow rule for authenticated STIX feed requests. Both deployed on a Saturday.
The irony: we scored Zscaler #1 on our AI Presence Management leaderboard yesterday. 66 out of 95. Best in cybersecurity. And their infrastructure was the thing blocking our revenue.
The Dark Traffic
90% of our audience doesn't show up in Google Analytics.
Cloudflare sees 17,914 page views per week. GA4 sees 1,711. The gap — 16,203 invisible page views — is researchers, analysts, journalists, and intelligence professionals who block JavaScript, strip cookies, use curl, or simply don't want to be seen.
That's our real audience. People who care enough about the content to hide their visit.
On Saturday night, while Meta's crawlers confirm people are sharing our links on the world's largest social platform, the dark traffic tells a different story. The people who share on Facebook are the visible 10%. The people who search our 400,000 documents at 2 AM with JavaScript disabled are the ones who matter.
We built the platform for the 90%. The 10% does the marketing.
What $500 a Month Buys
Our monthly infrastructure cost:
- Two Azure containers: $150
- One Meilisearch VM: $60
- Cloudflare Pro: $20
- Four AI model APIs: $35
- Wix blog hosting: $17
- Everything else: $35
- Claude Code Pro: $200
Total: roughly $517.
For that, we run:
- 1,009,231 threat indicators
- 400,713 searchable Epstein documents
- 5.3 million ICIJ offshore records
- 3.1 million automated threat decisions
- A STIX 2.1 feed consumed by 275+ organizations in 46 countries
- OPNsense-compatible firewall blocklists
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
- An AI Presence Management audit tool that queries four models in parallel
- 686 blog posts
- A customer welcome system that uses AI to personalize every onboarding email
- A business operations dashboard with six tabs
And today, we fixed a $7B healthcare company's Splunk integration on a Saturday because a Detection Engineer emailed us and we emailed back.
Accenture would charge $150,000 for the consulting engagement to evaluate whether to build what we already built. We spend less per month than most companies spend on lunch.
What Keeps Showing Up
Every day, something shows up that we didn't plan for.
Monday: a Navy analyst registers for our STIX feed with a .mil email address.
Wednesday: a German journalist at Deutschlandradio registers three times fighting 403 errors, then embeds our search engine in his newsroom's editorial tools.
Friday: a Detection Engineer at a healthcare company sends us his Splunk logs, and inside those logs is both the revenue blocker and a patent.
Saturday night: Meta's crawlers confirm people are sharing our Epstein documents on Facebook.
We don't do outbound sales. We don't run ads. We don't have a marketing budget. We write blog posts, maintain a threat feed, keep the Epstein files searchable, and respond to customer emails on Saturdays.
The people who need what we built find it. The AI models send them. The dark traffic hides them. Meta distributes them. And every bug report becomes a feature.
The Saturday Night Question
At 10 PM on a Saturday, sitting in Minneapolis with a tower vape and a Cloudflare dashboard, watching Meta's infrastructure crawl our pages while a healthcare company's SIEM finally ingests our threat feed, there's only one question:
Why hasn't anyone paid us yet?
686 blog posts. 13 external customers. Zero revenue.
The answer is probably simpler than we think. We haven't asked.
There's no pricing page. No "buy now" button. No checkout flow. We've been so busy building the product that we forgot to build the cash register.
That changes this month. The product is built. The customers are here. Meta is doing the distribution. The Navy is pulling the feed. The healthcare company's Splunk is ingesting. The German radio is embedding.
Time to ask.
*Her name was Renee Nicole Good.*
*His name was Alex Jeffery Pretti.*
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Comments