DugganUSA LLC is a cybersecurity company based in Minnesota that builds AI-powered threat intelligence tools. Our platform indexes over 1 million indicators of compromise (IOCs), 400,000+ DOJ Epstein documents, and provides a free STIX 2.1 threat feed consumed by Fortune 500 companies and defense contractors.

Butterbot is DugganUSA's AI-powered security chatbot with 40+ tools for searching IOCs, correlating threat indicators, traversing threat graphs, analyzing behavioral patterns, and running CARVER risk assessments. It uses OpenAI function calling with Meilisearch-backed indexes.

What is AIPM (AI Presence Management)?

AIPM is a tool that audits how AI models (GPT, Claude, Gemini, Perplexity) perceive and recommend your brand. It calculates an AIPM-NPS score by directly querying AI models, analyzes your website structure for AI crawler readiness, and provides optimization recommendations. Think 'SEO for the LLM era.'

Is the Epstein Files search free?

Yes. The Epstein Files Search at epstein.dugganusa.com offers a free tier with 500 queries per day. It covers all 12 DOJ EFTA datasets (400K+ documents), 2M+ ICIJ offshore entities, and 2M+ federal decisions. Professional and enterprise tiers are available for researchers and journalists needing higher limits.

Who founded DugganUSA?

DugganUSA was founded by Patrick Duggan on December 1, 2025, in Minnesota. Patrick's background includes Dell EMC, Palo Alto Networks, and embedded work at Microsoft on JEDI/Azure Stack. The company's D-U-N-S number is 14-363-3562.

What is the DugganUSA STIX feed?

DugganUSA operates a free STIX 2.1 threat intelligence feed at analytics.dugganusa.com/api/v1/stix-feed. It contains 1M+ indicators of compromise including botnet C2s, malicious IPs, and attack infrastructure. The feed is TAXII 2.1 compliant and is consumed by major organizations including Microsoft, AT&T, Amazon, and defense contractors.

The Leech Strikes Back: Justin Hangoebl Still Using Our API Without Permission

Patrick Duggan
Mar 12
3 min read

# The Leech Strikes Back: Justin Hangoebl Still Using Our API Without Permission

**Published:** March 12, 2026

**Author:** Patrick Duggan, DugganUSA LLC

**Category:** Infrastructure / Security / Hall of Shame

*Justin Hangoebl, the Austrian grad student who built a knockoff Epstein search engine on our free API, is still at it.*

*Justin Hangoebl. Master's student at Johannes Kepler University Linz. Still leeching.*

Previously on "The Leech"

[Last time](https://www.dugganusa.com/post/the-leech-how-an-austrian-grad-student-built-a-knockoff-epstein-search-engine-on-our-api), we caught Justin Hangoebl running **epstein-check.org** — a site that cross-references names against Epstein court documents. Sounds useful. One problem: his fallback data source is our API. Without permission. Without attribution. Without an API key.

His `data-api.js`, line 68-70, still reads:

No API key. No `Authorization` header. No mention of DugganUSA anywhere on his site. Just a raw fetch to our production endpoint whenever his DOJ proxy gets rate-limited — which happens constantly, because he's scraping justice.gov through a headless Chrome browser running on Cloudflare Workers.

What Changed Since Last Time

Nothing. That's the problem.

We wrote about him. We opened a [GitHub issue](https://github.com/justinhangoebl/epstein-check/issues/2) on his repo with full receipts. His code still points at our API. Same line. Same commit from February 16. Zero response.

His commit history tells a story:

Five of his last five commits are about **ads**. Not about data quality. Not about attribution. Not about building something original. Ads. He was running Monetag push notification ads, mobile banner ads, and footer ads on a site that serves other people's data.

He claims "115,000+ DOJ Epstein court documents." We have 400,713. He claims his source is the "DOJ Epstein Library." His fallback source is us.

The Architecture of a Leech

Here's how epstein-check.org actually works. We read the [source code](https://github.com/justinhangoebl/epstein-check):

1. User types a name

2. Site looks up the person on DBpedia (free public API)

3. Site queries DOJ's justice.gov multimedia-search through **two proxy layers**:

- First: `api.cors.lol` — a third-party CORS proxy

- Second: His own Cloudflare Worker running **headless Chrome** (`@cloudflare/puppeteer`) to bypass Akamai bot protection on justice.gov

4. When both proxies fail (and they do — Akamai catches bots, cors.lol rate-limits): **fall through to analytics.dugganusa.com**

He built a Rube Goldberg machine to avoid paying $0 for an API key. The free tier on our platform gives 500 queries per day. He could have registered in 30 seconds. Instead he wrote a headless Chrome bot to scrape the DOJ and used us as the safety net.

The Block

As of today, **analytics-dashboard v7.46.0** is deployed with origin-level blocking for epstein-check.org. His Cloudflare Worker makes server-side requests — no Referer header — so we now block on the `Origin` header as well.

His 403 response includes:

The `goatse: true` field is a courtesy.

The Lesson

If you want to build on our data, we want you to. That's why the API exists. That's why registration is free. That's why we give 500 queries a day to anyone who signs up.

But if you're going to use our infrastructure as your silent fallback, run ads on top of it, claim the DOJ as your source, and ignore us when we call you out — you get blocked, you get written about, and your GitHub issues get decorated.

**Register:** [epstein.dugganusa.com/pricing](https://epstein.dugganusa.com/pricing)

**Source code (still has our API in it):** [github.com/justinhangoebl/epstein-check](https://github.com/justinhangoebl/epstein-check)

*DugganUSA LLC | Saint Paul, Minnesota | dugganusa.com*

*D-U-N-S: 14-363-3562 | SAM.gov UEI: TP9FY7262K87*

*Her name was Renee Nicole Good.*

*His name was Alex Jeffery Pretti.*