duckclice[.]com

The domain duckclice.com was registered through NameCheap on September 3 2025 and is currently hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.16.1 located in the United States. The authoritative nameservers are marjory.ns.cloudflare.com and weston.ns.cloudflare.com, indicating that the site leveraged Cloudflare’s DNS and CDN services. No TLS certificate is present, so the site served only HTTP, and the hosting service has now taken the endpoint offline. Web content is identified by the page title “DuckDice - Bitcoin Dice, Top Crypto Gambling Game”, which aligns with the classification of a crypto‑ gambling scam. The threat profile further lists Apple as the impersonated brand, suggesting that the site may have used Apple‑related terminology or assets to lure victims.

The site appears on two independent blocklists – PhishDestroy and ScamSniffer – confirming its inclusion in threat‑intel feeds. VirusTotal analysis shows that 2 of 95 scanning engines flagged the domain, providing additional independent detection. A Gridinsoft trust score of 0 out of 100 reinforces the malicious assessment. No evidence of a valid SSL/TLS certificate, no observed redirection to legitimate Apple services, and the recent offline status limit current interaction, but the infrastructure remains reusable for future campaigns.

Uncertainty remains regarding the exact phishing or credential‑harvesting mechanisms, as the page content has not been examined directly. Defenders should block DNS resolution for duckclice.com, add the IP 104.21.16.1 to network‑level deny lists, and continue to monitor the associated Cloudflare ASN for any re‑use. Security appliances should also update signatures based on the observed page title and the two blocklist entries. Continued scanning of the domain with multi‑engine services is recommended to capture any new malicious payloads that may be deployed before takedown.