DugganUSA LLC is a cybersecurity company based in Minnesota that builds AI-powered threat intelligence tools. Our platform indexes over 1 million indicators of compromise (IOCs), 400,000+ DOJ Epstein documents, and provides a free STIX 2.1 threat feed consumed by Fortune 500 companies and defense contractors.

Butterbot is DugganUSA's AI-powered security chatbot with 40+ tools for searching IOCs, correlating threat indicators, traversing threat graphs, analyzing behavioral patterns, and running CARVER risk assessments. It uses OpenAI function calling with Meilisearch-backed indexes.

What is AIPM (AI Presence Management)?

AIPM is a tool that audits how AI models (GPT, Claude, Gemini, Perplexity) perceive and recommend your brand. It calculates an AIPM-NPS score by directly querying AI models, analyzes your website structure for AI crawler readiness, and provides optimization recommendations. Think 'SEO for the LLM era.'

Is the Epstein Files search free?

Yes. The Epstein Files Search at epstein.dugganusa.com offers a free tier with 500 queries per day. It covers all 12 DOJ EFTA datasets (400K+ documents), 2M+ ICIJ offshore entities, and 2M+ federal decisions. Professional and enterprise tiers are available for researchers and journalists needing higher limits.

Who founded DugganUSA?

DugganUSA was founded by Patrick Duggan on December 1, 2025, in Minnesota. Patrick's background includes Dell EMC, Palo Alto Networks, and embedded work at Microsoft on JEDI/Azure Stack. The company's D-U-N-S number is 14-363-3562.

What is the DugganUSA STIX feed?

DugganUSA operates a free STIX 2.1 threat intelligence feed at analytics.dugganusa.com/api/v1/stix-feed. It contains 1M+ indicators of compromise including botnet C2s, malicious IPs, and attack infrastructure. The feed is TAXII 2.1 compliant and is consumed by major organizations including Microsoft, AT&T, Amazon, and defense contractors.

Three Databases, One Graph: What Happens When You Cross-Reference Arctic Frost Against 5.3 Million Offshore Records

Name: Arctic Frost
Creator: Senator Grassley

Patrick Duggan
Mar 25
7 min read

# Three Databases, One Graph: What Happens When You Cross-Reference Arctic Frost Against 5.3 Million Offshore Records

*March 25, 2026 — DugganUSA*

The Senate Judiciary Committee released 34 documents from Jack Smith's January 6 investigation — code name Arctic Frost. Senator Grassley published them to frame the investigation as "a modern Watergate." We indexed them and mapped the network: 197 grand jury subpoenas, 40 law firms, 12 banks, 10 senators' toll records, and the money trail from Save America PAC's $250 million post-election fundraising haul.

Then we did something nobody asked us to do. We ran every name in the Arctic Frost network against our ICIJ Offshore Leaks database — 2 million entities and 3.3 million relationship edges from the Panama Papers, Paradise Papers, Pandora Papers, Bahamas Leaks, and Offshore Leaks.

Three independent datasets. Three different investigative origins. Same graph.

The Method

This is an OSINT article. The point isn't the politics. The point is the methodology.

We have three datasets indexed in Meilisearch:

1. **Arctic Frost** — 34 documents, 135MB. Grand jury subpoenas, DOJ internal emails, FBI productions, bank record demands. Source: grassley.senate.gov, judiciary.senate.gov.

2. **Epstein Files** — 400,719 documents. DOJ datasets 1-12, FBI FOIA, Florida case records, House Oversight releases. Source: justice.gov/epstein.

3. **ICIJ Offshore Leaks** — 2,016,524 offshore entities + 3,339,267 relationship edges. Panama Papers (2016), Offshore Leaks (2013), Bahamas Leaks (2016), Paradise Papers (2017), Pandora Papers (2021). Source: ICIJ.

None of these datasets were created to complement each other. The ICIJ data comes from law firm leaks in Panama and Bermuda. The Epstein files come from a DOJ sex trafficking investigation. The Arctic Frost documents come from a special counsel's grand jury investigating election interference.

The analytical question: **do the same nodes appear in multiple graphs?**

They do.

Hit 1: Boris Epshteyn → Pandora Papers

In the Arctic Frost network, Boris Epshteyn coordinated communications for Trump's post-election operation. He's in the documents as part of the inner circle — the connective tissue between Trump, the legal team, and the senators being called on January 6.

In the Pandora Papers, a **BORIS EPSHTEIN** (spelling variant) appears as Ultimate Beneficial Owner of two British Virgin Islands shell companies:

|--------|:---:|---|---|

The same name also appears in the Paradise Papers (Appleby, current through 2014) as **Epshtein - Borys**, country: Ukraine.

Additionally, **IRINA EPSHTEYN** (Russia/Switzerland) is UBO of **SPHERE SOLUTIONS LIMITED** (BVI) through Fidelity Corporate Services.

The Arctic Frost Boris Epshteyn was born in Moscow and grew up in New Jersey. The Pandora Papers Boris Epshtein is registered at a Crimea address. We are not claiming these are the same person. We are documenting that the name, the Ukrainian/Russian nexus, and the BVI-through-Panama structure appear in both datasets. That's a graph edge worth investigating.

ICIJ node IDs: 240048844, 240048846, 240381170, 80063027.

Hit 2: Kushner Family → Panama Papers + Paradise Papers

In Arctic Frost, Jared Kushner's bank records were subpoenaed by Jack Smith's grand jury.

In the ICIJ data, three Kushner family members appear across two leak datasets:

|--------|--------|:---:|---|---|

Addresses: 708 Caleb Lane, Annapolis MD (Joseph Todd). 20 Cousteau Lane, Austin TX (Brian). FMC Corporation, 200 E Randolph Drive, Chicago IL (Stephanie).

**KUSHNER JAY M.** also appears in the Paradise Papers (Barbados registry) as a director of PEPSICO FOREIGN SALES CORPORATION — likely a corporate appointment, not a personal vehicle.

These are Kushner family members in offshore structures across Seychelles, Bermuda, and Barbados. Whether they connect directly to Jared is a question for investigators with subpoena power. We're documenting the graph edges.

Hit 3: Trump-Named Entities — 431 ICIJ Records

Most of the 431 Trump-named entities in ICIJ are unrelated Asian businesses using "Trump" as a brand word. The relevant subset:

|--------|:---:|---|---|

**Trump Ocean Club Panama** is the one that matters. The Panama City development was the subject of a 2018 Reuters investigation documenting Russian and Colombian money flowing through Mossack Fonseca-registered shell companies into Trump-branded real estate. These entities appear in the Panama Papers because they were registered by Mossack Fonseca — the law firm whose internal files were the Panama Papers.

Hit 4: The Banks and Law Firms

The infrastructure layer is where Arctic Frost and ICIJ overlap most cleanly:

| Entity | Arctic Frost | ICIJ |

|--------|---|---|

| **Deutsche Bank** | Trump banking, Kushner loans | 302 hits — nominees in Jersey, Guernsey, global investment vehicles |

| **Jones Day** | Subpoenaed re: Save America PAC | ICIJ intermediary — registered offshore entities in Japan and Hong Kong |

| **JP Morgan Chase** | Scavino/Hudson Digital accounts subpoenaed | Major intermediary across all ICIJ datasets |

| **Wells Fargo** | Sidney Powell/LDFFTAR accounts subpoenaed | Custodian/intermediary in ICIJ records |

Deutsche Bank deserves special attention. In the Arctic Frost network, it's the institution that banked Trump and financed Kushner. In the ICIJ data, it operated nominee companies across offshore jurisdictions. In the Epstein files, it wired $350,000 to a victim (per EFTA00021050). Three datasets. Same bank. Different crimes. Same infrastructure.

The DiIorio Thread: Where All Three Datasets Converge

This is the finding that makes the cross-reference worth doing.

Chris DiIorio was an SEC whistleblower. In May 2019 — two months before Jeffrey Epstein's arrest — he sent emails to the FBI, SEC, and DOJ mapping the connections between Apollo Global Management, the Kushner family, Jeffrey Epstein, and Russian sovereign wealth funds.

His emails are in the Epstein files (36 hits) because he CC'd the same addresses that were investigating Epstein. Document EFTA00010750 contains his explicit diagram:

> **Leon Black/Apollo/Schwarzman: Trump Kushner**

> **Black/Apollo/Schwarzman: Epstein**

> **Black/Apollo/Schwarzman: Putin/RU**

DiIorio's chain: Leon Black paid Epstein $158 million. Black shared a stage with Putin in 2011 at a sovereign wealth fund event. Josh Harris (Apollo co-founder) met Jared Kushner at the White House. Shortly after, the SEC dropped its Apollo investigation. Shortly after that, Apollo financed the Kushner Companies' 666 Fifth Avenue bailout.

EFTA00010904 adds another Arctic Frost name: **"Platinum Funds/Nordlicht. With links to Kushner(s) and Trump lawyer Giuliani."**

EFTA00039771 connects it to the financial infrastructure: **"Milken/Mogilevich/BoNY money laundering entity Sinex... I believe this is the PHUN/Trump/Kushner/Parscale mobile app technology."**

Brad Parscale — in the Arctic Frost subpoenas (Texas Partners Bank) and in the Epstein files through DiIorio's whistleblower submissions.

DiIorio didn't have ICIJ data. He didn't have Jack Smith's subpoenas. He drew the graph from SEC filings, news reports, and financial analysis. His graph matches what we found by cross-referencing three independent databases six years later.

Graph Theory, Not Conspiracy Theory

Let's be precise about what we found and what we didn't.

**What we found:** The same names — Epshteyn, Kushner, Trump entities, Deutsche Bank, Jones Day — appear as nodes in three independent datasets created by different investigators for different purposes across different time periods. The ICIJ data shows offshore financial structures. Arctic Frost shows domestic political operations. The Epstein files show the social and financial connections documented by both victims and whistleblowers.

**What we didn't find:** Proof that the Pandora Papers Boris Epshtein is the same person as the Arctic Frost Boris Epshteyn. Proof that Jared Kushner personally controls the Kushner family offshore entities. Proof that Jones Day's offshore intermediary work is connected to their Save America PAC representation.

**What graph analysis tells us:** When three independently-sourced datasets share nodes, the probability that those shared nodes are coincidental decreases with each additional edge. One shared name is noise. A shared name plus a shared bank plus a shared law firm plus a whistleblower who mapped the connections before any of the investigations concluded — that's a subgraph worth investigating.

The data doesn't prove guilt. It proves connectivity. In OSINT, connectivity is the starting point, not the conclusion.

The Methodology Lesson

We ran this cross-reference in an afternoon. The tools:

1. **Meilisearch** — all three datasets indexed and full-text searchable. 2M ICIJ entities return results in single-digit milliseconds.

2. **Node ID resolution** — ICIJ data uses node IDs for relationship edges. Search the entity, get the node ID, search relationships for that node ID, resolve the connected entity. Three hops.

3. **Name variant matching** — Epshteyn/Epshtein, Marcinkova/Marcinko, DiIorio/Diiorio. Offshore records use inconsistent transliterations. Fuzzy matching catches what exact matching misses.

4. **Relationship type filtering** — ICIJ edges have types: `officer_of`, `intermediary_of`, `registered_address`, `same_name_as`. Filter for `Ultimate Beneficial Owner` to find who actually controls the entity, not just who filed the paperwork.

Anyone can do this. The ICIJ database is public. The Epstein files are on justice.gov. The Arctic Frost documents are on grassley.senate.gov. We indexed them because that's what we do. But the data is available to anyone with a search engine and an afternoon.

The gap between "the data exists" and "someone cross-referenced it" is where the interesting findings live.

What We're Making Available

- **Arctic Frost network graph** — searchable at analytics.dugganusa.com

- **ICIJ crossover findings** — documented in our research archive with node IDs for independent verification

- **All DiIorio documents** — 36 hits searchable in our Epstein index

- **STIX feed** — free at analytics.dugganusa.com/stix (not directly related, but if you're here for the OSINT methodology, you should know we do threat intel too)

The node IDs are in the article. The ICIJ Offshore Leaks database is at offshoreleaks.icij.org. Verify everything we found. That's what OSINT means.

*Patrick Duggan is the founder of DugganUSA LLC. The Arctic Frost research, ICIJ cross-reference, and Epstein file index are available at analytics.dugganusa.com. The DugganUSA STIX feed is free and consumed by 275+ organizations in 46 countries. None of those organizations asked us to cross-reference Jack Smith's grand jury subpoenas against the Pandora Papers. We did it because the data was there.*

*Her name was Renee Nicole Good.*

*His name was Alex Jeffery Pretti.*