https://auth.duck.fyi/if/flow/default-authentication-flow/?client_id=69GkuW5C37YR7j4ninFx1dV6CdiMfRvgmC8zN8jM&redirect_uri=https%3A%2F%2Fauth.duck.fyi%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=openid+ak_proxy+entitlements+profile+email&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0LzY5R2t1VzVDMzdZUjdqNG5pbkZ4MWRWNkNkaU1mUnZnbUM4ek44ak0iLCJzaWQiOiJhdXRoZW50aWtfcHJveHlfc2Vzc2lvbl9iOTliOTEyNC0zZjMyLTRlOTktYjM4ZC0zNTcyNDY2ZDAzNzMiLCJzdGF0ZSI6Inc1ejkySmxLcGZxbmNpVTZhT3EzYUp4ZWJMaXVyMmhxclV0aDJPdzlHS1kiLCJyZWRpcmVjdCI6Imh0dHBzOi8vdHdpdHRlci5kdWNrLmZ5aS8ifQ.yRlqAZ5hSx8mJZB8k5oBCoHoFmWghl57tYyU7ACDh6U&next=%2Fapplication%2Fo%2Fauthorize%2F%3Fclient_id%3D69GkuW5C37YR7j4ninFx1dV6CdiMfRvgmC8zN8jM%26redirect_uri%3Dhttps%253A%252F%252Fauth.duck.fyi%252Foutpost.goauthentik.io%252Fcallback%253FX-authentik-auth-callback%253Dtrue%26response_type%3Dcode%26scope%3Dopenid%2Bak_proxy%2Bentitlements%2Bprofile%2Bemail%26state%3DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0LzY5R2t1VzVDMzdZUjdqNG5pbkZ4MWRWNkNkaU1mUnZnbUM4ek44ak0iLCJzaWQiOiJhdXRoZW50aWtfcHJveHlfc2Vzc2lvbl9iOTliOTEyNC0zZjMyLTRlOTktYjM4ZC0zNTcyNDY2ZDAzNzMiLCJzdGF0ZSI6Inc1ejkySmxLcGZxbmNpVTZhT3EzYUp4ZWJMaXVyMmhxclV0aDJPdzlHS1kiLCJyZWRpcmVjdCI6Imh0dHBzOi8vdHdpdHRlci5kdWNrLmZ5aS8ifQ.yRlqAZ5hSx8mJZB8k5oBCoHoFmWghl57tYyU7ACDh6U

Redirected from twitter.duck.fyi

Impersonating ducknet

Intent: Data collection

• Domain is not operated by ducknet

login page requesting email/username and password input to access nginx