yuckyducks[.]xyz

Analysis indicates that the domain yuckyducks.xyz was registered on 22 December 2025 through NiceNIC International Group Co., Limited. The site advertised a “Yucky Ducks NFT Giveaway” according to the page title captured before takedown. Infrastructure inspection shows the domain resolves to IP address 72.61.152.50, which belongs to AS47583 Hostinger International Limited located in Germany. The hosting environment uses LiteSpeed web server software and advertises support for HTTP/3, consistent with Hostinger’s service stack. DNS resolution is delegated to Cloudflare name servers amit.ns.cloudflare.com and michelle.ns.cloudflare.com, suggesting the operator employed Cloudflare’s CDN and protection services.

The domain presented a valid TLS certificate issued by Let’s Encrypt (R12), confirming that HTTPS connections were available when the site was live. Security scanners on VirusTotal recorded nine positive detections out of ninety‑three vendors, and the Gridinsoft trust score is zero out of one hundred, indicating a high confidence of malicious intent. The site was classified as a “Giveaway Scam” and the broader scam type is identified as a crypto scam, aligning with the NFT giveaway narrative. PhishDestroy has already added the domain to its blocklist, and it appears on one additional security blocklist, reinforcing the consensus that the domain is malicious. Current monitoring shows the domain is offline, preventing direct content retrieval, which limits further behavioural analysis.

Nonetheless, the combination of a recent registration date, low trust score, multiple vendor detections, and inclusion on known phishing blocklists provides sufficient evidence for defensive actions. Recommendations for security teams include immediate blocking of yuckyducks.xyz at perimeter and DNS layers, adding the associated IP 72.61.152.50 to host‑based deny lists, and flagging any outbound traffic to the Cloudflare name servers for this domain.