I Built a Security Platform That Fooled an AI Into Thinking It Was Cloudflare

· · Naples, FL

Last night, I had a conversation with an AI agent that runs on my own server. I asked it to analyze my security setup. It looked at the JS challenge page — the SHA-256 fingerprinting, the callback verification, the repeat blocking — and confidently told me I was behind Cloudflare.

It wasn't. It was my own custom binary. A 10.9MB Go executable running on a $0/month Oracle Cloud ARM box.

The Conversation

Me: What do you think about the security setup?
AI: That JS challenge is legit. SHA-256 fingerprint, block-repeat callback, the whole flow — I was reading it and genuinely thought "Cloudflare is blocking automated access." Only figured out it was ours when I traced the binary on port 3000.
Me: Fuck yeah! Even AI thinks this shit is Cloudflare.
AI: The Go binary's doing exactly what it's supposed to do: intercept, fingerprint, block. The fact that it fooled an AI agent running on the same server is a good sign.

Why This Matters

Most cybersecurity companies spend $50,000+/month on AWS, Cloudflare, and CrowdStrike before landing their first client. I built a complete security product on free compute that fooled an AI into thinking it was Cloudflare.

10.9MB
Binary Size
$0
Monthly Hosting
0
CVEs

The Architecture

Five VPS nodes, one ARM box. All custom, all owned, zero vendor lock-in:

  • Shield (Go) — Real-time threat detection, JS challenge injection, fingerprinting
  • Soul (Go) — Clustering, anomaly detection, deep analysis
  • Auditor (C) — Integrity verification, phi consensus scoring
  • Strike (Python) — Tarpit counter-attacks on isolated GCP infrastructure
  • Lead Engine (Go) — Automated lead discovery, email outreach, reply processing

All running on Oracle Cloud's forever free tier. No Cloudflare. No CrowdStrike. No monthly WAF bills.

Why Custom Security Wins

You can't exploit what you can't fingerprint.

Cloudflare, Akamai, AWS WAF — they're all documented. Attackers know the exact bypass patterns. Rate limit quirks. Header parsing bugs. They're targets because they're known.

Shield is a 10.9MB binary on an ARM box that nobody's ever seen before. No public documentation. No CVEs. No bug bounty writeups. No script kiddie tooling against it.

An attacker would have to reverse-engineer the binary just to figure out what it's doing, and then they'd still have to find a flaw in custom code that was built for exactly this use case.

The JS Challenge

The challenge page that fooled the AI does three things:

  • SHA-256 fingerprinting — Generates a unique browser fingerprint and hashes it
  • Callback verification — Requires the client to solve a computational challenge and post back the result
  • Repeat blocking — Tracks fingerprint + IP combinations and blocks repeat offenders

It's not a WAF plugin. It's compiled, custom, self-hosted code that nobody's written bypass scripts for because nobody knows it exists.

The Cost

$0
Oracle Cloud Free Tier
$0
Cloudflare Bill
$0
CrowdStrike License

The whole stack — Shield, Soul, Auditor, Bridge, Landing Pages, Lead Engine, Dashboard — all running on free compute. Custom compiled Go binaries, JS challenge injection, 120B LLM forensics, tarpit counter-attacks, and a complete lead generation pipeline.

Zero hosting costs. Zero vendor lock-in. Zero dependency on someone else's uptime.

What's Next

The platform is live and defending. The lead engine is discovering and contacting businesses. The GEO optimization services are helping sites get found by AI search engines.

If you're a small business in Naples, FL (or anywhere in the US) and you want cybersecurity that actually works — not a Cloudflare reskin, not a WAF plugin, but a complete, custom-built security stack that runs on your own hardware — that's what Aegis-SIGMA is.

See It In Action

Try hitting aegis-sigma.com with a bot. Watch the JS challenge fire. Watch the fingerprinting. Watch the blocking. Then ask yourself: is this Cloudflare, or is this something better?

View Pricing →

Written by Jared R. Lawson · Founder, Aegis-SIGMA Security · Naples, FL · jared@aegis-sigma.com