duckchech[.]pages[.]dev

Security researchers at PhishDestroy identify a phishing domain, duckchech.pages.dev, currently posing as the login portal for Duck Creek Technologies, a provider of insurance software and SaaS solutions. This domain is actively engaged in credential harvesting, tricking users into submitting sensitive login details under false pretenses. Current analysis marks this domain as 'active' and under further investigation due to its potential impact on enterprise environments relying on Duck Creek Technologies services.

This domain, duckchech.pages.dev, was flagged by 8 of 95 VirusTotal vendors as of the most recent scan, indicating it has evaded broad detection despite its malicious intent. It resolves to the IP address 188.114.97.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services SSL certificates to appear legitimate. Notably, the domain has not yet appeared on major threat intelligence blocklists, though its low detection rate suggests a stealthy, newly deployed campaign targeting users seeking access to Duck Creek portals.

Given the domain's active status and zero detections on VirusTotal, immediate caution is advised. Organizations and users interacting with Duck Creek Technologies services should verify all login URLs through official communication channels. Implementing browser-based controls to block known phishing domains, alongside user awareness training, is strongly recommended to mitigate the risk of credential theft. Security teams are urged to monitor for any internal reports of failed login attempts or unusual account activity linked to this domain. Blocking the IP address 188.114.97.3 at the network perimeter may also reduce exposure.