If you've come across api-9ca043fb.duosecurity.com, you might wonder whether it's safe. The short answer is yes — this is a technical endpoint used by Duo Security, a reputable cybersecurity company that is now part of Cisco. The subdomain immediately redirects to their main website, duo.com, and carries all the security protections you'd expect: a valid SSL certificate, HTTPS enforcement, and a clean record on Google's threat detection. No malware or phishing flags are attached to this address. Since it's not a standalone website but an API redirect, you won't find a favicon, contact page, or sitemap here — that's normal for this kind of infrastructure. The parent domain, duosecurity.com, is well-established and transparent about ownership. If you're asking "is api-9ca043fb.duosecurity.com a scam?" the evidence says no. It's simply a behind-the-scenes URL that points to the real Duo Security site. There's no risk to visiting or interacting with it.
In plain English
This is a Duo Security API endpoint that simply redirects to the main Duo website. All security checks pass, and there are no signs of foul play. It's a legitimate part of a well-known security company's infrastructure. You have nothing to worry about.
Where the score comes from
The site uses a valid SSL certificate, enforces HTTPS, and has modern security headers like Content Security Policy. No malware or phishing flags appear anywhere. This is exactly what you would expect from a legitimate security company's infrastructure.
This is a subdomain of duosecurity.com, which belongs to Duo Security, a well-known cybersecurity company owned by Cisco. The WHOIS record for the subdomain itself is not available, but that is normal for subdomains. The parent domain is clearly identifiable.
The site is not found on any blacklists and has no history of abuse. It has no web archive presence, but that is typical for a technical API endpoint that just redirects. The main Duo brand has a strong, long-standing reputation.
The subdomain itself does not display contact info or an about page because it immediately redirects to duo.com. The parent site, duo.com, provides full transparency about the company. For a redirect endpoint, this is standard and not a concern.
No legal pages are present on this subdomain, but it is not a consumer-facing site. The main duo.com site has privacy policy and terms of service. Since this endpoint just redirects, there is no compliance gap here.
The site uses Amazon Web Services hosting, has a valid SSL certificate, and enforces HTTPS. DNSSEC is not enabled, which is common for subdomains. The server configuration is straightforward and appropriate for a redirect.
What we checked
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Get your badge →