How to recognize it

User agents, as they reach our logs:

DuckDuckBot/1.1; (+http://duckduckgo.com/duckduckbot.html)
'DuckDuckBot-Https/1.1; (+https://duckduckgo.com/duckduckbot)'
DuckDuckBot-Https/1.1; (+https://duckduckgo.com/duckduckbot)
  • First string: the only one DuckDuckGo documents.
  • Second string: includes the single quotes, and it was the most common of the three. A parser that strips or rejects quoted values miscounts it.
  • Version 1.0: also turned up.

Match on DuckDuckBot, which covers the -Https variant.

  • robots.txt token: DuckDuckBot
  • IP list (JSON): duckduckbot.json
  • Reverse DNS: none published.

What it does

DuckDuckBot crawls to improve DuckDuckGo’s search results. DuckDuckGo says it respects robots.txt through the Perl WWW::RobotRules library, and gives no word on Crawl-delay.

What you gain by allowing it

  • Appearing in DuckDuckGo’s results from its own index, with links.

What you lose

By allowing it

  • Little load: on our sites it fetched only 34 different paths in 8 days.

By blocking it

  • Whatever DuckDuckGo’s results draw from its own crawl. Its AI answers are controlled separately, through DuckAssistBot.

How to verify it

Match the IP against duckduckbot.json. The file holds 486 single addresses and is byte for byte the same as duckassistbot.json. An IP check proves “DuckDuckGo”, not which of its two bots. Cloudflare flags the real crawler as “Search Engine Crawler”. Our trackers do not check the list yet.

Gotchas and history

  • Shared IP list: a firewall rule that allows DuckDuckBot by IP also allows DuckAssistBot. Separate them by user agent.
  • Quoted user agent: the quoted form looks like a broken client, but it came from DuckDuckGo’s network and carried Cloudflare’s flag.

What we observed

Data: Cloudflare Logpush for two of our sites, 19-26 October 2026 (8 days).

  • 482 requests, all flagged by Cloudflare, all from Microsoft’s network (AS8075). The scanner did not use this name.
  • 370 used the quoted DuckDuckBot-Https string, 69 the documented one, 28 the unquoted -Https form and 15 version 1.0.
  • 34 different paths, 14 of the requests for /robots.txt, and 128 redirects.

About DuckDuckGo

  • DuckDuckBot crawls for DuckDuckGo’s search results.
  • DuckAssistBot fetches pages in real time for its AI-assisted answers. DuckDuckGo says that data does not train AI models, and that a block takes 72 hours and leaves organic rankings alone.

The two IP lists are the same file, so an IP check cannot tell the bots apart. Their tokens can.

Sources