How to recognize it

User agents, the real one first, then the scanner’s:

DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)
DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)

DuckDuckGo documents version 1.2 with an http://...html link. The scanner on our sites sent version 1.1 with a different link and no semicolon. Match on DuckAssistBot, then check the IP.

  • robots.txt token: DuckAssistBot
  • IP list (JSON): duckassistbot.json
  • Reverse DNS: none published.

What it does

DuckAssistBot crawls in real time to build DuckDuckGo’s AI-assisted answers, which cite their sources. DuckDuckGo states that the data is not used in any way to train AI models.

What you gain by allowing it

  • Being cited, with a link, in DuckDuckGo’s AI answers.

What you lose

By allowing it

  • Your content summarised in an answer that may satisfy the reader without a click.

By blocking it

  • Those citations. DuckDuckGo says a block takes 72 hours and does not change organic rankings.

How to verify it

Match the IP against duckassistbot.json, which is the same file as duckduckbot.json. Cloudflare flags the real fetcher as “AI Assistant”. Our trackers do not check the list yet.

Gotchas and history

  • Fake share: 99% of requests with this name on our sites came from the scanner. Counting DuckAssist by user agent measures the costume.
  • Opt-out problems: DuckDuckGo handles these at [email protected].

What we observed

Data: Cloudflare Logpush for two of our sites, 19-26 October 2026 (8 days).

  • 766 requests carried a DuckAssistBot user agent:
    • 761 came from the Google Cloud scanner with the version 1.1 string;
    • 5 were real: version 1.2, from Microsoft’s network (AS8075), flagged by Cloudflare. All 5 were for /robots.txt.

About DuckDuckGo

  • DuckDuckBot crawls for DuckDuckGo’s search results.
  • DuckAssistBot fetches pages in real time for its AI-assisted answers. DuckDuckGo says that data does not train AI models, and that a block takes 72 hours and leaves organic rankings alone.

The two IP lists are the same file, so an IP check cannot tell the bots apart. Their tokens can.

Sources