URL: https://x6do1.staged-by-discourse.com/
Submission Tags: phishingrod
Submission: On February 27 via api from DE — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2602:fd3f:3:ff02::2b, located in United States and belongs to HURRICANE, US. The main domain is x6do1.staged-by-discourse.com.
TLS certificate: Issued by R3 on February 27th 2023. Valid for: 3 months.
This is the only time x6do1.staged-by-discourse.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2602:fd3f:3:f... 6939 (HURRICANE)
6 2600:9000:225... 16509 (AMAZON-02)
7 2
Apex Domain
Subdomains
Transfer
6 discourse-cdn.com
sea2.discourse-cdn.com — Cisco Umbrella Rank: 56159
345 KB
1 staged-by-discourse.com
x6do1.staged-by-discourse.com
3 KB
7 2
Domain Requested by
6 sea2.discourse-cdn.com x6do1.staged-by-discourse.com
sea2.discourse-cdn.com
1 x6do1.staged-by-discourse.com
7 2

This site contains no links.

Subject Issuer Validity Valid
x6do1.staged-by-discourse.com
R3
2023-02-27 -
2023-05-28
3 months crt.sh
sea2.discourse-cdn.com
Amazon RSA 2048 M02
2023-02-08 -
2024-03-09
a year crt.sh

This page contains 1 frames:

Primary Page: https://x6do1.staged-by-discourse.com/
Frame ID: 61C9A25429860C6EDE60F25767D4CE23
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Discourse Setup

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

348 kB
Transfer

368 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
x6do1.staged-by-discourse.com/
3 KB
3 KB
Document
General
Full URL
https://x6do1.staged-by-discourse.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2602:fd3f:3:ff02::2b , United States, ASN6939 (HURRICANE, US),
Reverse DNS
Software
nginx /
Resource Hash
7504f4526c8a348988adfe190b42ab5d34be9c6ff3212a08cd8cd0e2ceed03a1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://x6do1.staged-by-discourse.com/logs/ https://x6do1.staged-by-discourse.com/sidekiq/ https://x6do1.staged-by-discourse.com/mini-profiler-resources/ https://global.discourse-cdn.com/x6do1staging/assets/ https://global.discourse-cdn.com/x6do1staging/brotli_asset/ https://x6do1.staged-by-discourse.com/extra-locales/ https://sea2.discourse-cdn.com/x6do1staging/highlight-js/ https://sea2.discourse-cdn.com/x6do1staging/javascripts/ https://sea2.discourse-cdn.com/x6do1staging/plugins/ https://sea2.discourse-cdn.com/x6do1staging/theme-javascripts/ https://sea2.discourse-cdn.com/x6do1staging/svg-sprite/ 'sha256-Gty3/aPWFfSvz7pdT39HY97/+2opLup9V0L19ZF0IwY='; worker-src 'self' https://global.discourse-cdn.com/x6do1staging/assets/ https://global.discourse-cdn.com/x6do1staging/brotli_asset/ https://sea2.discourse-cdn.com/x6do1staging/javascripts/ https://sea2.discourse-cdn.com/x6do1staging/plugins/; frame-ancestors 'self'; manifest-src 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store
cdck-proxy-id
app-router-tiehunter02.sea2 app-balancer-tieinterceptor1b.sea2
content-encoding
gzip
content-security-policy
upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://x6do1.staged-by-discourse.com/logs/ https://x6do1.staged-by-discourse.com/sidekiq/ https://x6do1.staged-by-discourse.com/mini-profiler-resources/ https://global.discourse-cdn.com/x6do1staging/assets/ https://global.discourse-cdn.com/x6do1staging/brotli_asset/ https://x6do1.staged-by-discourse.com/extra-locales/ https://sea2.discourse-cdn.com/x6do1staging/highlight-js/ https://sea2.discourse-cdn.com/x6do1staging/javascripts/ https://sea2.discourse-cdn.com/x6do1staging/plugins/ https://sea2.discourse-cdn.com/x6do1staging/theme-javascripts/ https://sea2.discourse-cdn.com/x6do1staging/svg-sprite/ 'sha256-Gty3/aPWFfSvz7pdT39HY97/+2opLup9V0L19ZF0IwY='; worker-src 'self' https://global.discourse-cdn.com/x6do1staging/assets/ https://global.discourse-cdn.com/x6do1staging/brotli_asset/ https://sea2.discourse-cdn.com/x6do1staging/javascripts/ https://sea2.discourse-cdn.com/x6do1staging/plugins/; frame-ancestors 'self'; manifest-src 'self'
content-type
text/html; charset=utf-8
date
Mon, 27 Feb 2023 22:29:18 GMT
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding Accept
x-content-type-options
nosniff
x-discourse-route
finish_installation/index
x-discourse-trackview
1
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
37f97568-dda4-44ed-ae4a-3668c2e0bb8e
x-xss-protection
0
wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css
sea2.discourse-cdn.com/x6do1staging/stylesheets/
24 KB
5 KB
Stylesheet
General
Full URL
https://sea2.discourse-cdn.com/x6do1staging/stylesheets/wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css?__ws=x6do1.staged-by-discourse.com
Requested by
Host: x6do1.staged-by-discourse.com
URL: https://x6do1.staged-by-discourse.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:fc00:1c:507a:72c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
0bea2130a64caed1be4a1cbf6c8faa25b978f5c0adc81639ab7a3aafd13b432f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x6do1.staged-by-discourse.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Mon, 27 Feb 2023 22:29:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
via
1.1 77517a7f5d9094d359ba5186c3bda1e6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
x-discourse-route
stylesheets/show
content-transfer-encoding
binary
content-disposition
inline; filename="wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css"; filename*=UTF-8''wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css
x-cdck-cacheable
True
x-xss-protection
0
x-request-id
f0edf73b-707c-41ae-ae79-21881b89e464
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 27 Feb 2023 22:23:29 GMT
server
nginx
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31556952, public, immutable
x-amz-cf-id
3jXr1ghp7hJfSazYNWNc56wBqVzj6G92ixWrofLuAmDpvDmbmIThwQ==
cdck-proxy-id
app-router-tiehunter03.sea2, app-balancer-tieinterceptor1a.sea2
color_definitions_base__1_387223eac3622d7c645f42fc40870d8ae188a2d8.css
sea2.discourse-cdn.com/x6do1staging/stylesheets/
3 KB
2 KB
Stylesheet
General
Full URL
https://sea2.discourse-cdn.com/x6do1staging/stylesheets/color_definitions_base__1_387223eac3622d7c645f42fc40870d8ae188a2d8.css?__ws=x6do1.staged-by-discourse.com
Requested by
Host: x6do1.staged-by-discourse.com
URL: https://x6do1.staged-by-discourse.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:fc00:1c:507a:72c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
5454d8d96ab049b3623ff91acc82ae11121ff19d5551bb901d5143247be621e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x6do1.staged-by-discourse.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Mon, 27 Feb 2023 22:29:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
via
1.1 77517a7f5d9094d359ba5186c3bda1e6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
x-discourse-route
stylesheets/show
content-transfer-encoding
binary
content-disposition
inline; filename="color_definitions_base__1_387223eac3622d7c645f42fc40870d8ae188a2d8.css"; filename*=UTF-8''color_definitions_base__1_387223eac3622d7c645f42fc40870d8ae188a2d8.css
x-cdck-cacheable
True
x-xss-protection
0
x-request-id
6b00b8f2-4cbf-41bc-b4ac-5049df4d4b89
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 27 Feb 2023 22:23:30 GMT
server
nginx
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31556952, public, immutable
x-amz-cf-id
wuXEv7A_4pETEKM9YAxWVrSLeg2PYbS3Yi9elCDWsha4zhwx7eoOCQ==
cdck-proxy-id
app-router-tiehunter03.sea2, app-balancer-tieinterceptor1a.sea2
color_definitions_dark_1_1_00d1f8e9dd0f24c104315e90c546511102d390fc.css
sea2.discourse-cdn.com/x6do1staging/stylesheets/
3 KB
2 KB
Stylesheet
General
Full URL
https://sea2.discourse-cdn.com/x6do1staging/stylesheets/color_definitions_dark_1_1_00d1f8e9dd0f24c104315e90c546511102d390fc.css?__ws=x6do1.staged-by-discourse.com
Requested by
Host: x6do1.staged-by-discourse.com
URL: https://x6do1.staged-by-discourse.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:fc00:1c:507a:72c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
9a06081c61d04a5a29ebb1dd1033ab052d80c83f8c14ca62ca53918bb82056fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x6do1.staged-by-discourse.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Mon, 27 Feb 2023 22:29:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
via
1.1 77517a7f5d9094d359ba5186c3bda1e6.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
none
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
x-discourse-route
stylesheets/show
content-transfer-encoding
binary
content-disposition
inline; filename="color_definitions_dark_1_1_00d1f8e9dd0f24c104315e90c546511102d390fc.css"; filename*=UTF-8''color_definitions_dark_1_1_00d1f8e9dd0f24c104315e90c546511102d390fc.css
x-cdck-cacheable
True
x-xss-protection
0
x-request-id
31ad6a4f-54c0-4741-b5d6-b6f17a2dbea5
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 27 Feb 2023 22:23:30 GMT
server
nginx
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31556952, public, immutable
x-amz-cf-id
nhCfscgtCOaE1WLAlQHmSt3JO8U4-L42k34ZeVdr2PkBH8rMG7tbMw==
cdck-proxy-id
app-router-tiehunter02.sea2, app-balancer-tieinterceptor1a.sea2
branded-background.svg
sea2.discourse-cdn.com/x6do1staging/images/
1 KB
1 KB
Image
General
Full URL
https://sea2.discourse-cdn.com/x6do1staging/images/branded-background.svg
Requested by
Host: sea2.discourse-cdn.com
URL: https://sea2.discourse-cdn.com/x6do1staging/stylesheets/wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css?__ws=x6do1.staged-by-discourse.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:fc00:1c:507a:72c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
fffdf4ec109ea90aac1e90aa72fd2ee76784db5dc935d3b7e624d6ab35be02e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sea2.discourse-cdn.com/x6do1staging/stylesheets/wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css?__ws=x6do1.staged-by-discourse.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Mon, 27 Feb 2023 22:29:19 GMT
content-encoding
gzip
via
1.1 77517a7f5d9094d359ba5186c3bda1e6.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000
last-modified
Mon, 27 Feb 2023 22:05:04 GMT
server
nginx
x-amz-cf-pop
FRA60-P4
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
image/svg+xml
x-cdck-cacheable
True
x-amz-cf-id
CWxiDgDxQz9Y55YAjFFPHXh0Z2xvYkIIjcOXGZL2DA5CNkjrvI1IJQ==
cdck-proxy-id
app-router-tiehunter02.sea2, app-balancer-tieinterceptor1a.sea2
Roboto-Bold.ttf
sea2.discourse-cdn.com/x6do1staging/fonts/
166 KB
167 KB
Font
General
Full URL
https://sea2.discourse-cdn.com/x6do1staging/fonts/Roboto-Bold.ttf?v=0.0.9
Requested by
Host: sea2.discourse-cdn.com
URL: https://sea2.discourse-cdn.com/x6do1staging/stylesheets/wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css?__ws=x6do1.staged-by-discourse.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:fc00:1c:507a:72c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
c9cc991deb5d27f267830a19f2301eb164d9e61ec08669c1a1a291c5620ff40a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://sea2.discourse-cdn.com/x6do1staging/stylesheets/wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css?__ws=x6do1.staged-by-discourse.com
Origin
https://x6do1.staged-by-discourse.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Mon, 27 Feb 2023 22:29:19 GMT
strict-transport-security
max-age=31536000
via
1.1 02cd8164e89a1598d410a9198582d47c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
content-length
170348
x-cdck-cacheable
True
last-modified
Wed, 22 Feb 2023 00:28:32 GMT
server
nginx
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000, public,immutable
accept-ranges
bytes
x-amz-cf-id
p2ah1ufOpUdhsgawEJgZEVTsi4WufhCOKHWk6kAqj8EM-CLDfL5jRg==
cdck-proxy-id
app-router-tiehunter03.sea2, app-balancer-tieinterceptor1a.sea2
expires
Tue, 27 Feb 2024 22:29:19 GMT
Roboto-Regular.ttf
sea2.discourse-cdn.com/x6do1staging/fonts/
167 KB
168 KB
Font
General
Full URL
https://sea2.discourse-cdn.com/x6do1staging/fonts/Roboto-Regular.ttf?v=0.0.9
Requested by
Host: sea2.discourse-cdn.com
URL: https://sea2.discourse-cdn.com/x6do1staging/stylesheets/wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css?__ws=x6do1.staged-by-discourse.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:fc00:1c:507a:72c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
017c0be9aaa6d0359737e1fa762ad304c0e0107927faff5a6c1f415c7f5244ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://sea2.discourse-cdn.com/x6do1staging/stylesheets/wizard_6f18362107b09abe5763eb0ecc374e42e308fa27.css?__ws=x6do1.staged-by-discourse.com
Origin
https://x6do1.staged-by-discourse.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date
Mon, 27 Feb 2023 22:29:19 GMT
strict-transport-security
max-age=31536000
via
1.1 02cd8164e89a1598d410a9198582d47c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P4
x-cache
Miss from cloudfront
content-length
171272
x-cdck-cacheable
True
last-modified
Wed, 22 Feb 2023 00:28:32 GMT
server
nginx
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000, public,immutable
accept-ranges
bytes
x-amz-cf-id
-SSd0WVZTygwppznENWjqEa1GUe2eyGEAV5d8EUkSzpEigeRDOyc1Q==
cdck-proxy-id
app-router-tiehunter02.sea2, app-balancer-tieinterceptor1a.sea2
expires
Tue, 27 Feb 2024 22:29:19 GMT

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests; base-uri 'self'; object-src 'none'; script-src https://x6do1.staged-by-discourse.com/logs/ https://x6do1.staged-by-discourse.com/sidekiq/ https://x6do1.staged-by-discourse.com/mini-profiler-resources/ https://global.discourse-cdn.com/x6do1staging/assets/ https://global.discourse-cdn.com/x6do1staging/brotli_asset/ https://x6do1.staged-by-discourse.com/extra-locales/ https://sea2.discourse-cdn.com/x6do1staging/highlight-js/ https://sea2.discourse-cdn.com/x6do1staging/javascripts/ https://sea2.discourse-cdn.com/x6do1staging/plugins/ https://sea2.discourse-cdn.com/x6do1staging/theme-javascripts/ https://sea2.discourse-cdn.com/x6do1staging/svg-sprite/ 'sha256-Gty3/aPWFfSvz7pdT39HY97/+2opLup9V0L19ZF0IwY='; worker-src 'self' https://global.discourse-cdn.com/x6do1staging/assets/ https://global.discourse-cdn.com/x6do1staging/brotli_asset/ https://sea2.discourse-cdn.com/x6do1staging/javascripts/ https://sea2.discourse-cdn.com/x6do1staging/plugins/; frame-ancestors 'self'; manifest-src 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0