I can, read please and test iplogger.
With this url attackers can get user ps ip if send it via private messages or get origin ip for the ddos. Discourse don’t have setting to allow only trust domain.
https://meta.discourse.org/t/discourse-v3-0-is-here-join-our-live-webinar-january-24th-10am-pst/251997/11?u=hellcx9rv4