urlscan.io logo urlscan.io
SecurityTrails logo

origin-stage.mastercard.com Open in urlscan Pro
209.64.211.243  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://origin-stage.mastercard.com/
Effective URL: https://origin-stage.mastercard.com/en-us.html
Submission Tags: falconsandbox
Submission: On January 10 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 209.64.211.243, located in United States and belongs to MASTER-7-AS, US. The main domain is origin-stage.mastercard.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on January 7th 2025. Valid for: a year.
This is the only time origin-stage.mastercard.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 5 209.64.211.243 26380 (MASTER-7-AS)
3 2600:9000:275... 16509 (AMAZON-02)
1 104.102.46.186 16625 (AKAMAI-AS)
1 2600:9000:225... 16509 (AMAZON-02)
10 5
Apex Domain
Subdomains		 Transfer
6 mastercard.com
origin-stage.mastercard.com
stage.asset.mastercard.com
16 KB
4 dynamicyield.com
cdn.dynamicyield.com — Cisco Umbrella Rank: 8471
st.dynamicyield.com — Cisco Umbrella Rank: 7736
159 KB
0 mastercard.us Failed
stage.mastercard.us Failed
10 3
Domain Requested by
5 origin-stage.mastercard.com 1 redirects origin-stage.mastercard.com
3 cdn.dynamicyield.com origin-stage.mastercard.com
st.dynamicyield.com
1 st.dynamicyield.com origin-stage.mastercard.com
1 stage.asset.mastercard.com origin-stage.mastercard.com
0 stage.mastercard.us Failed
10 5

This site contains no links.

Subject Issuer Validity Valid
stage.mastercard.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-01-07 -
2026-01-06		 a year crt.sh
*.dynamicyield.com
Amazon RSA 2048 M03		 2024-08-18 -
2025-09-16		 a year crt.sh

This page contains 1 frames:

Primary Page: https://origin-stage.mastercard.com/en-us.html
Frame ID: 5507EA792A208FC51A3E5F62047D813E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Your Page Title Goes Here

Page URL History Show full URLs

  1. https://origin-stage.mastercard.com/ HTTP 301
    https://origin-stage.mastercard.com/en-us.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /etc\.clientlibs/
Overall confidence: 100%
Detected patterns
  • cdn\.dynamicyield\.\w+/

Page Statistics

10
Requests

90 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

175 kB
Transfer

627 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://origin-stage.mastercard.com/ HTTP 301
    https://origin-stage.mastercard.com/en-us.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://origin-stage.mastercard.com/content/dam/dxp/favicon/mastercard-favicon.svg HTTP 302
  • https://stage.mastercard.us/en-us/404.html

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request en-us.html
origin-stage.mastercard.com/
Redirect Chain
  • https://origin-stage.mastercard.com/
  • https://origin-stage.mastercard.com/en-us.html
79 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://origin-stage.mastercard.com/en-us.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.64.211.243 , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
origin-stage.mastercard.us
Software
Apache /
Resource Hash
75f3b12be899ff60dbb485564a209132b4449ab71c22c7887def7292b495bbcd
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN, SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
https://maps.googleapis.com
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
12254
Content-Security-Policy
frame-ancestors 'self'
Content-Type
text/html
Date
Fri, 10 Jan 2025 17:01:40 GMT
ETag
"13c8f-61992ba256b38-gzip"
Keep-Alive
timeout=300, max=94
Last-Modified
Wed, 29 May 2024 07:30:39 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN, SAMEORIGIN

Redirect headers

Connection
Keep-Alive
Content-Length
254
Content-Type
text/html; charset=iso-8859-1
Date
Fri, 10 Jan 2025 17:01:40 GMT
Keep-Alive
timeout=300, max=95
Location
https://origin-stage.mastercard.com/en-us.html
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Frame-Options
SAMEORIGIN
api_dynamic.js
cdn.dynamicyield.com/api/8782028/ 		36 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.dynamicyield.com/api/8782028/api_dynamic.js
Requested by
Host: origin-stage.mastercard.com
URL: https://origin-stage.mastercard.com/en-us.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:275d:bc00:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
DYCDN /
Resource Hash
7638ce77f15daacef331bdfe29dfc5ffd634455fc9a78141710906d7ee13192d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://origin-stage.mastercard.com/

Response headers

vary
accept-encoding
link
<//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
cache-control
max-age=30
content-encoding
gzip
etag
W/"d84460f45dd1a12963c2ffd13d12413c"
via
1.1 d025091c574ce1bcf1fefea59ac34f2c.cloudfront.net (CloudFront)
x-cache
RefreshHit from cloudfront
x-amz-cf-id
U6emdWaQ_hfbMH05vHDUe4fsruteW7PWqA_kCNZcPFf_vNrnXijK8w==
date
Fri, 10 Jan 2025 17:01:41 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 06 Jan 2025 09:36:32 GMT
server
DYCDN
x-amz-cf-pop
FRA56-P11
x-amz-server-side-encryption
AES256
api_static.js
cdn.dynamicyield.com/api/8782028/ 		392 KB
116 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.dynamicyield.com/api/8782028/api_static.js
Requested by
Host: origin-stage.mastercard.com
URL: https://origin-stage.mastercard.com/en-us.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:275d:bc00:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
DYCDN /
Resource Hash
740c889c03b1a11cabf9083e3d50223605431a913315fd76e443e13b7834b44f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://origin-stage.mastercard.com/

Response headers

vary
accept-encoding
link
<//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
cache-control
max-age=28800
content-encoding
gzip
etag
W/"262f2dce30e9b077271145f6ca1a01bd"
via
1.1 d025091c574ce1bcf1fefea59ac34f2c.cloudfront.net (CloudFront)
x-cache
RefreshHit from cloudfront
x-amz-cf-id
Es6w2fs9tAqy6cqmURYdM3D2WpeFKwejJk-txRS6Mb7W7Q6lu1AXYA==
date
Fri, 10 Jan 2025 17:01:41 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 06 Jan 2025 09:36:32 GMT
server
DYCDN
x-amz-cf-pop
FRA56-P11
x-amz-server-side-encryption
AES256
skip-to-content-clientlibs.6a0f0a90c51172989eb9f62b9b650a79.css
origin-stage.mastercard.com/etc.clientlibs/dxp/clientlibs/ 		865 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://origin-stage.mastercard.com/etc.clientlibs/dxp/clientlibs/skip-to-content-clientlibs.6a0f0a90c51172989eb9f62b9b650a79.css
Requested by
Host: origin-stage.mastercard.com
URL: https://origin-stage.mastercard.com/en-us.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.64.211.243 , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
origin-stage.mastercard.us
Software
Apache /
Resource Hash
d44344a79601d1e336360bce0a5e63303acf0b537e4c429bee50104a3051dcde
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://origin-stage.mastercard.com/en-us.html

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
ETag
"361-62b04d0b7358e-gzip"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
484
Keep-Alive
timeout=300, max=93
Date
Fri, 10 Jan 2025 17:01:40 GMT
Last-Modified
Mon, 06 Jan 2025 07:45:41 GMT
Vary
Accept-Encoding
Server
Apache
Content-Type
text/css
X-Frame-Options
SAMEORIGIN
clientlib-base.js
origin-stage.mastercard.com/etc.clientlibs/dxp/clientlibs/ 		476 B
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://origin-stage.mastercard.com/etc.clientlibs/dxp/clientlibs/clientlib-base.js
Requested by
Host: origin-stage.mastercard.com
URL: https://origin-stage.mastercard.com/en-us.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.64.211.243 , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
origin-stage.mastercard.us
Software
Apache /
Resource Hash
5c97a02d420d9e93c0ceb0da07ea24e1aca21afb088b80e724ed642cb15906fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://origin-stage.mastercard.com/en-us.html

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
ETag
"1dc-62b04035bac06-gzip"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
306
Keep-Alive
timeout=300, max=92
Date
Fri, 10 Jan 2025 17:01:40 GMT
Last-Modified
Mon, 06 Jan 2025 06:48:16 GMT
Vary
Accept-Encoding
Server
Apache
Content-Type
text/javascript
X-Frame-Options
SAMEORIGIN
dxp-web.esm.js
stage.asset.mastercard.com/dxp-ui/dxp-web@7.5.12-rc.1/dxp-web/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://stage.asset.mastercard.com/dxp-ui/dxp-web@7.5.12-rc.1/dxp-web/dxp-web.esm.js
Requested by
Host: origin-stage.mastercard.com
URL: https://origin-stage.mastercard.com/en-us.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.102.46.186 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-46-186.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=600, max-age=600
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://origin-stage.mastercard.com
Referer
https://origin-stage.mastercard.com/

Response headers

strict-transport-security
max-age=600, max-age=600
cache-control
max-age=1296000
expires
Sat, 25 Jan 2025 17:01:40 GMT
access-control-allow-origin
*
content-length
196
date
Fri, 10 Jan 2025 17:01:40 GMT
content-type
text/html; charset=iso-8859-1
x-frame-options
SAMEORIGIN
st
st.dynamicyield.com/ 		10 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://st.dynamicyield.com/st?sec=8782028&inHead=true&id=0&jsession=&ref=&scriptVersion=2.46.0&dyid_server=&ctx=%7B%22type%22%3A%22HOMEPAGE%22%7D&noConsent=true
Requested by
Host: origin-stage.mastercard.com
URL: https://origin-stage.mastercard.com/en-us.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:ec00:15:ad21:c740:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
d64b116687f364b1e034c31073e834e6bef084c8971e85bcbf519f7deabfd46a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://origin-stage.mastercard.com/

Response headers

cache-control
no-cache
content-encoding
gzip
via
1.1 d20f19c14113bb86116d01e6cb4e2844.cloudfront.net (CloudFront)
expires
Fri, 10 Jan 2025 17:01:39 GMT
access-control-allow-origin
*
x-cache
Miss from cloudfront
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-amz-cf-id
LSH-LEHI7Z-ejrGvA10pFHCwsCN9iHsZT4hwhr3c6LCUrYDYDH49Qg==
date
Fri, 10 Jan 2025 17:01:40 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
x-amz-cf-pop
FRA60-P2
dy-coll-nojq-min.js
cdn.dynamicyield.com/scripts/2.46.0/ 		105 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.dynamicyield.com/scripts/2.46.0/dy-coll-nojq-min.js
Requested by
Host: st.dynamicyield.com
URL: https://st.dynamicyield.com/st?sec=8782028&inHead=true&id=0&jsession=&ref=&scriptVersion=2.46.0&dyid_server=&ctx=%7B%22type%22%3A%22HOMEPAGE%22%7D&noConsent=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:275d:bc00:a:b89d:a6c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
DYCDN /
Resource Hash
eda5a60907a91960c55958a28dcc789a1dec47bbf12b07d2508c567501e9a27d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://origin-stage.mastercard.com/

Response headers

vary
accept-encoding
link
<//st.dynamicyield.com>; rel="dns-prefetch", <//st.dynamicyield.com>; rel="preconnect", <//rcom.dynamicyield.com>; rel="dns-prefetch", <//rcom.dynamicyield.com>; rel="preconnect", <//async-px.dynamicyield.com>; rel="dns-prefetch", <//async-px.dynamicyield.com>; rel="preconnect"
cache-control
max-age=31536000
content-encoding
gzip
etag
W/"7afcbc711aa3bd4f1df95885b71191e9"
age
2188471
via
1.1 d025091c574ce1bcf1fefea59ac34f2c.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
VCae8Lt55CD-2i67EhkPlsxV8Lq2UO-lOYcM8D3mzT8T589vUJQi_Q==
date
Mon, 16 Dec 2024 09:07:11 GMT
content-type
text/javascript
last-modified
Mon, 09 Dec 2024 12:18:46 GMT
server
DYCDN
x-amz-cf-pop
FRA56-P11
x-amz-server-side-encryption
AES256
404.html
stage.mastercard.us/en-us/
Redirect Chain
  • https://origin-stage.mastercard.com/content/dam/dxp/favicon/mastercard-favicon.svg
  • https://stage.mastercard.us/en-us/404.html
0
0
mastercardfavicon.ico
origin-stage.mastercard.com/content/dam/dxp/favicon/ 		4 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://origin-stage.mastercard.com/content/dam/dxp/favicon/mastercardfavicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.64.211.243 , United States, ASN26380 (MASTER-7-AS, US),
Reverse DNS
origin-stage.mastercard.us
Software
Apache /
Resource Hash
554dd98056bde131c3acf2ec3bed5b0c13eeb386d44650fb2c56b3f066d9e13e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://origin-stage.mastercard.com/en-us.html

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
ETag
"113e-61992ba5f54e6-gzip"
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
487
Keep-Alive
timeout=300, max=90
Date
Fri, 10 Jan 2025 17:01:41 GMT
Last-Modified
Wed, 29 May 2024 07:30:42 GMT
Vary
Accept-Encoding
Server
Apache
Content-Type
image/x-icon
X-Frame-Options
SAMEORIGIN

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
stage.mastercard.us
URL
https://stage.mastercard.us/en-us/404.html

Verdicts & Comments Add Verdict or Comment

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| DY object| DYExps object| DYO object| contextManager object| DYJSON function| whenAvailable function| createDyidServerCookie function| updateDYTracking function| checkOneTrustSettings function| onOneTrustConsentChange function| createDyidServerCookieOnLoad string| isDisabled object| dateArr object| currentDate number| currentMonth number| currentDay number| currentYear number| currentDateUtc object| bannerCarousels number| j object| child string| programName string| pageName string| jcrLang string| countryCode string| locale string| siteSection string| siteType string| contentType string| pageTitle string| pageType string| loginType string| hierarchy string| siteSection1 string| en_siteSection1 string| en_siteSection2 string| cluster object| di object| DYWork function| $dy

1 Cookies

Domain/Path Name / Value
origin-stage.mastercard.com/ Name: BIGipServerstage.dm.mc.us-https-pool
Value: !G/1rlwfdMaFBmhi6R2ISHHz0vMgqlDgSgGLdlkZ3VBSSbL3eTo1FFYrNCQOVptACxspBP2cSZVjvYQ==

1 Console Messages

Source Level URL
Text
network error URL: https://stage.asset.mastercard.com/dxp-ui/dxp-web@7.5.12-rc.1/dxp-web/dxp-web.esm.js
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN, SAMEORIGIN