duck[.]ag

The domain duck.ag is assessed as having an elevated risk level, specifically for credential theft. This domain was taken offline and has been identified as a potential threat, suggesting that it was likely used to capture sensitive user information such as login credentials.

Infrastructure analysis reveals that duck.ag resolves to the IP address 172.67.73.52, which is located in the United States and is part of Cloudflare, Inc.'s network (AS13335). The domain was registered through Dynadot LLC on August 21, 2025. The SSL certificate is issued by Let's Encrypt, which is a common choice for legitimate and malicious sites alike. According to VirusTotal, 12 out of 95 security vendors have flagged this domain as malicious. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, which further corroborates the elevated risk assessment.

To mitigate the risk of credential theft, users should avoid interacting with any content or forms on duck.ag. It is recommended to use multi-factor authentication (MFA) for all online accounts and to monitor account activity for any unauthorized access. Security teams should configure firewalls and web filters to block access to this domain and educate users about the signs of phishing attacks, such as suspicious URLs, unexpected requests for personal information, and untrusted SSL certificates. Regularly updating security software and conducting phishing awareness training can also help prevent such attacks.