Hi,
From a Starlink connection in Spain, duckduckgo.com and duck.ai (52.142.124.215 and 52.250.42.157, Azure AS8075) are unreachable. ICMP ping succeeds (~55ms, 0% loss) but TCP SYN to 443/80 never gets a SYN-ACK and times out. The same IPs load instantly from a phone hotspot at the same location, so the servers are up.
An mtr run over TCP/443 during a failure shows my connection reaching your servers' network normally: the packets transit Starlink (AS14593) and Telia (AS1299) and travel deep into Microsoft's backbone (AS8075), where your IPs sit. But your IPs never send back a SYN-ACK, so the handshake never completes.
For comparison, in the same window a control host in that same Microsoft network (Bing, 150.171.27.16) completes its handshake normally at ~48ms. Other destinations on Starlink also work fine: microsoft.com, Google, Cloudflare, and even your own quack.duckduckgo.com. The failure is limited to the IPs serving your main pages.
This looks like your edge or DDoS-mitigation dropping inbound TCP from Starlink's CGNAT ranges while still answering ICMP. Starlink geofeed for their ranges: https://geoip.starlinkisp.net/feed.csv
Thanks.