urlscan.io logo urlscan.io
SecurityTrails logo

nngcu.speedoffered.com Open in urlscan Pro
144.202.71.48  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://pop.sevillafc.es/NzEHDGJqMvmKBRx.ncugqnj?gAAAAABlyza1GqGV-c05Cc_auJTrhw1DFwOPbVEsEXzy0GbaTMv-443HJF3yuiGXwQWzkpsa...
Effective URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Submission: On February 13 via api from BE — Scanned from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 9 domains to perform 16 HTTP transactions. The main IP is 144.202.71.48, located in Dallas, United States and belongs to AS-CHOOPA, US. The main domain is nngcu.speedoffered.com.
TLS certificate: Issued by R3 on December 10th 2023. Valid for: 3 months.
This is the only time nngcu.speedoffered.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 192.198.125.2 55286 (SERVER-MANIA)
1 23.229.68.13 55286 (SERVER-MANIA)
2 9 144.202.71.48 20473 (AS-CHOOPA)
1 142.250.186.106 15169 (GOOGLE)
1 104.17.25.14 13335 (CLOUDFLAR...)
5 172.64.111.3 13335 (CLOUDFLAR...)
1 142.250.185.67 15169 (GOOGLE)
16 6
1    192.198.125.2 (Buffalo, United States)

ASN55286 (SERVER-MANIA, CA)
pop.sevillafc.es
1    23.229.68.13 (Buffalo, United States)

ASN55286 (SERVER-MANIA, CA)
PTR: birdrobo.net
pompousposterity.com
9    144.202.71.48 (Dallas, United States)

ASN20473 (AS-CHOOPA, US)
PTR: bwh7251.bitcoinwebhosting.net
1ibeg.suggestedspins.com
nngcu.connectmyoffers.com
nngcu.speedoffered.com
1    142.250.186.106 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f10.1e100.net
fonts.googleapis.com
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
5    172.64.111.3 (United States)

ASN13335 (CLOUDFLARENET, US)
trk-consulatu.com
event.trk-consulatu.com
1    142.250.185.67 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f3.1e100.net
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
7 speedoffered.com
nngcu.speedoffered.com
328 KB
5 trk-consulatu.com
trk-consulatu.com — Cisco Umbrella Rank: 83863
event.trk-consulatu.com — Cisco Umbrella Rank: 164773
3 KB
1 gstatic.com
fonts.gstatic.com
28 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223
6 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
907 B
1 connectmyoffers.com
nngcu.connectmyoffers.com
705 B
1 suggestedspins.com
1ibeg.suggestedspins.com
179 B
1 pompousposterity.com
pompousposterity.com
467 B
1 sevillafc.es
pop.sevillafc.es
280 B
16 9
Domain Requested by
7 nngcu.speedoffered.com pompousposterity.com
nngcu.speedoffered.com
4 event.trk-consulatu.com trk-consulatu.com
1 fonts.gstatic.com fonts.googleapis.com
1 trk-consulatu.com nngcu.speedoffered.com
1 cdnjs.cloudflare.com nngcu.speedoffered.com
1 fonts.googleapis.com nngcu.speedoffered.com
1 nngcu.connectmyoffers.com 1 redirects
1 1ibeg.suggestedspins.com 1 redirects
1 pompousposterity.com
1 pop.sevillafc.es 1 redirects
16 10

This site contains no links.

Subject Issuer Validity Valid
pompousposterity.com
Sectigo RSA Domain Validation Secure Server CA		 2023-02-21 -
2024-03-13		 a year crt.sh
speedoffered.com
R3		 2023-12-10 -
2024-03-09		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
trk-consulatu.com
GTS CA 1P5		 2023-12-26 -
2024-03-25		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2024-01-09 -
2024-04-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Frame ID: 5515414FCD473D2D124F970DED0F6F1F
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Opportunity Search

Page URL History Show full URLs

  1. http://pop.sevillafc.es/NzEHDGJqMvmKBRx.ncugqnj?gAAAAABlyza1GqGV-c05Cc_auJTrhw1DFwOPbVEsEXzy0GbaTMv-... HTTP 302
    https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-... Page URL
  2. https://1ibeg.suggestedspins.com/?kw=690099&s1=690099&s2=1_1086727_2794446&s3=1410390306&s4=45 HTTP 301
    https://nngcu.connectmyoffers.com/o/WEMETJTX HTTP 302
    https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

9
Domains

10
Subdomains

6
IPs

2
Countries

366 kB
Transfer

399 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://pop.sevillafc.es/NzEHDGJqMvmKBRx.ncugqnj?gAAAAABlyza1GqGV-c05Cc_auJTrhw1DFwOPbVEsEXzy0GbaTMv-443HJF3yuiGXwQWzkpsa_VfIV6J1n-718gjvyyIeOMP4JXCTTP2sMnlMalVb7gE1vPjTWrVn9Eyn0bNpGlXBmg-JzcPbSKJSaI8mgTpH2_fWiA==== HTTP 302
    https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-24-249-140 Page URL
  2. https://1ibeg.suggestedspins.com/?kw=690099&s1=690099&s2=1_1086727_2794446&s3=1410390306&s4=45 HTTP 301
    https://nngcu.connectmyoffers.com/o/WEMETJTX HTTP 302
    https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://pop.sevillafc.es/NzEHDGJqMvmKBRx.ncugqnj?gAAAAABlyza1GqGV-c05Cc_auJTrhw1DFwOPbVEsEXzy0GbaTMv-443HJF3yuiGXwQWzkpsa_VfIV6J1n-718gjvyyIeOMP4JXCTTP2sMnlMalVb7gE1vPjTWrVn9Eyn0bNpGlXBmg-JzcPbSKJSaI8mgTpH2_fWiA==== HTTP 302
  • https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-24-249-140

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
1092008590_88-24-249-140
pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/
Redirect Chain
  • http://pop.sevillafc.es/NzEHDGJqMvmKBRx.ncugqnj?gAAAAABlyza1GqGV-c05Cc_auJTrhw1DFwOPbVEsEXzy0GbaTMv-443HJF3yuiGXwQWzkpsa_VfIV6J1n-718gjvyyIeOMP4JXCTTP2sMnlMalVb7gE1vPjTWrVn9Eyn0bNpGlXBmg-JzcPbSKJSa...
  • https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-24-249-140
157 B
467 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-24-249-140
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.229.68.13 Buffalo, United States, ASN55286 (SERVER-MANIA, CA),
Reverse DNS
birdrobo.net
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Connection
close
Content-Length
157
Content-Type
text/html; charset=UTF-8
Date
Tue, 13 Feb 2024 11:48:32 GMT
Server
Apache

Redirect headers

Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Tue, 13 Feb 2024 11:48:29 GMT
Location
https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-24-249-140
Server
Apache
Primary Request d2879414-ca65-11ee-bdd4-c702cd99f5aa
nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/
Redirect Chain
  • https://1ibeg.suggestedspins.com/?kw=690099&s1=690099&s2=1_1086727_2794446&s3=1410390306&s4=45
  • https://nngcu.connectmyoffers.com/o/WEMETJTX
  • https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
9 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Requested by
Host: pompousposterity.com
URL: https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-24-249-140
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
144.202.71.48 Dallas, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
bwh7251.bitcoinwebhosting.net
Software
swoole-http-server /
Resource Hash
b44db79e5b41e7bb5bc30fda5f54242fe94d9a28144bab7ca7a13be246c885d5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://pompousposterity.com/1761a867b0031993800/1_1086727_2794446/2423_6665576_5149370_29/1092008590_88-24-249-140
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

cache-control
no-cache, private
content-encoding
br
content-length
3329
content-type
text/html; charset=UTF-8
date
Tue, 13 Feb 2024 11:48:39 GMT
server
swoole-http-server
strict-transport-security
max-age=15768000
x-redir
true

Redirect headers

cache-control
no-cache, private
content-encoding
br
content-length
281
content-type
text/html; charset=UTF-8
date
Tue, 13 Feb 2024 11:48:36 GMT
location
https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
server
swoole-http-server
strict-transport-security
max-age=15768000
x-redir
true
style.css
nngcu.speedoffered.com/templates/templates/opportunity_themes/css/ 		7 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nngcu.speedoffered.com/templates/templates/opportunity_themes/css/style.css
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
144.202.71.48 Dallas, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
bwh7251.bitcoinwebhosting.net
Software
swoole-http-server /
Resource Hash
3e9e92a2c92ee923648445212bb4a83511593efc699f50d8205c354d5260aab1
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
es-ES,es;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 04:04:20 GMT
via
1.1 varnish (Varnish/7.3)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
27858
x-varnish
299480 196638
content-type
text/css
accept-ranges
bytes
content-length
7595
app-96551fdc.css
nngcu.speedoffered.com/build/assets/ 		37 KB
37 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nngcu.speedoffered.com/build/assets/app-96551fdc.css
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
144.202.71.48 Dallas, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
bwh7251.bitcoinwebhosting.net
Software
swoole-http-server /
Resource Hash
96551fdc589d4d84ef73a9beef052ee8f33519d4187b7c1c5bc996140c29674a
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
es-ES,es;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 04:04:20 GMT
via
1.1 varnish (Varnish/7.3)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
27859
x-varnish
1088226 393231
content-type
text/css
accept-ranges
bytes
content-length
37870
app-0fc6666a.js
nngcu.speedoffered.com/build/assets/ 		40 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nngcu.speedoffered.com/build/assets/app-0fc6666a.js
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
144.202.71.48 Dallas, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
bwh7251.bitcoinwebhosting.net
Software
swoole-http-server /
Resource Hash
9772a2fbaf5b0a2b78fd4f598c56e0f2b64038df1dd615500deaaffc488752eb
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
Origin
https://nngcu.speedoffered.com
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 04:04:20 GMT
via
1.1 varnish (Varnish/7.3)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
27859
x-varnish
299481 458772
content-type
application/javascript
accept-ranges
bytes
content-length
40602
service-worker-allowed
/
css2
fonts.googleapis.com/ 		2 KB
907 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Quicksand:wght@400;700&display=swap
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f10.1e100.net
Software
ESF /
Resource Hash
b16a2a13d4ab55ef39042b40c65f72ecd15aa828cdfbad45949d262685a323cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
es-ES,es;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 13 Feb 2024 11:48:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 13 Feb 2024 11:36:36 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 13 Feb 2024 11:48:39 GMT
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
es-ES,es;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 11:48:39 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
932028
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y31a5gB7fGLKtE3E2nxEwG8pTWrOwx7%2BPtOHZg0BbvPIuQSSSxzozAdfTDgcg4WYmozQPl%2BwqJEtYxd11mAQf8lkTb8peREkPyAofgKxyhjC7%2FnWSWQ1gT21RvUObGeukLJWrpFu"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
854cd7f5a8cc71fd-MAD
expires
Sun, 02 Feb 2025 11:48:39 GMT
finder-logo-casino.png
nngcu.speedoffered.com/templates/templates/opportunity_themes/img/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nngcu.speedoffered.com/templates/templates/opportunity_themes/img/finder-logo-casino.png
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
144.202.71.48 Dallas, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
bwh7251.bitcoinwebhosting.net
Software
swoole-http-server /
Resource Hash
407f2b116d25634c81824006fb0312a53cadad5e45fef0fdd9d254b8b3008e7f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
es-ES,es;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 04:04:20 GMT
via
1.1 varnish (Varnish/7.3)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
27859
x-varnish
299484 458774
content-type
image/png
accept-ranges
bytes
content-length
36675
300x200.jpg
nngcu.speedoffered.com/media/template-images/revolution-white-background/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nngcu.speedoffered.com/media/template-images/revolution-white-background/300x200.jpg
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
144.202.71.48 Dallas, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
bwh7251.bitcoinwebhosting.net
Software
AmazonS3 /
Resource Hash
3e1a879bfa73de7eb7c6307920a215516015bd7d0d841601bd57542cc3e91c93
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
es-ES,es;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 04:04:22 GMT
via
1.1 varnish (Varnish/7.3)
strict-transport-security
max-age=15768000
last-modified
Mon, 11 Dec 2023 18:12:55 GMT
server
AmazonS3
age
27859
etag
"dfffe66be881eeeb0f2c189774442b4b"
x-amz-server-side-encryption
AES256
content-type
image/jpeg
x-varnish
1088230 458776
cache-control
max-age=604800
accept-ranges
bytes
content-length
8346
oldw7nlgzn
trk-consulatu.com/scripts/push/script/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.111.3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0956218009fe6721f2afb9728dada5de28059cc6301b34b06fce2824a6321ac
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 11:48:40 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4370
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
last-modified
Tue, 13 Feb 2024 10:35:50 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n8Zgn9dlCS5ynGkzSE%2F38EF9Tn3t8fiwmOZ2%2FYUX%2FIvuxViKJ1kUkOGIE9INlSyuYZPVQIDQieNixUJ%2BeXu8E05ai%2FR7gqt44RmXxDSj3UMG4y%2Fce6W3KqaYdLPADFtgEP1%2FNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
max-age=14400, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
854cd7fa9ab38675-MAD
expires
0
casino-bg.png
nngcu.speedoffered.com/templates/templates/opportunity_themes/img/ 		195 KB
195 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nngcu.speedoffered.com/templates/templates/opportunity_themes/img/casino-bg.png
Requested by
Host: nngcu.speedoffered.com
URL: https://nngcu.speedoffered.com/templates/templates/opportunity_themes/css/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
144.202.71.48 Dallas, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
bwh7251.bitcoinwebhosting.net
Software
swoole-http-server /
Resource Hash
ca23a9beb0ea2e71d1fe8764af7388e529fcaed54ffcbec61b37546066c36bd7
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://nngcu.speedoffered.com/templates/templates/opportunity_themes/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 04:04:21 GMT
via
1.1 varnish (Varnish/7.3)
strict-transport-security
max-age=15768000
server
swoole-http-server
age
27859
x-varnish
1088231 458778
content-type
image/png
accept-ranges
bytes
content-length
199203
6xKtdSZaM9iE8KbpRA_hK1QN.woff2
fonts.gstatic.com/s/quicksand/v31/ 		27 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/quicksand/v31/6xKtdSZaM9iE8KbpRA_hK1QN.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Quicksand:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.67 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s48-in-f3.1e100.net
Software
sffe /
Resource Hash
5a42c91e1ecc9b09346a1520d9a6f98074c13eebfb1cc87c4e82e5992beb685b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://nngcu.speedoffered.com
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

date
Tue, 13 Feb 2024 08:56:40 GMT
x-content-type-options
nosniff
age
10320
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
28064
x-xss-protection
0
last-modified
Wed, 13 Sep 2023 23:22:14 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 12 Feb 2025 08:56:40 GMT
lmdzxr03ek
event.trk-consulatu.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-consulatu.com/register/event_log/lmdzxr03ek
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.111.3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://nngcu.speedoffered.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
854cd804499c3148-MAD
content-length
0
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
date
Tue, 13 Feb 2024 11:48:42 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V9QVrvsWP7OkElrN%2BSUJYhJtqX6muRrGSQMyfpXIO2hisqhrQaNkbXsw6Vx%2F%2FjlGjPJQNPBz1PvpYMZuO5Zj8es9cOuieZ%2FV49DFQ0734HNVQ2kU9y43paEdpy1qUbBR9HRdV9BVW1FbhA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
lmdzxr03ek
event.trk-consulatu.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-consulatu.com/register/event_log/lmdzxr03ek
Requested by
Host: trk-consulatu.com
URL: https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.111.3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Tue, 13 Feb 2024 11:48:42 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fs8N8bxhn9PuGRskzKfiM8FfzRbcpimTvIKStZaMQEKm5NrUNzpiYIVawU%2FRFqdaWo5agln9xt%2BwDLCmEuOlkzgcisT6h8C11S51S3Uzllh1SJfhtspyYWvUTf1YrmevbNogREln6NLvVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
854cd8057bae3148-MAD
x-pushplatformapp-params
lmdzxr03ek
event.trk-consulatu.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-consulatu.com/register/event_log/lmdzxr03ek
Requested by
Host: trk-consulatu.com
URL: https://trk-consulatu.com/scripts/push/script/oldw7nlgzn?url=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.111.3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Tue, 13 Feb 2024 11:48:42 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kb24KJawgFrD0C8e6BroYRnv3aZDsZSrgyCeVBx%2FMYdfigmnntGyhWz3GGH9mFodKFHM8OthdThS92Y7jjpOeGeQjmus%2ByExdCgQclp2RjcZSoiqJHA1f4CQyZTxaRAZCdYVgv5O%2FbqwiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
cache-control
no-cache, no-store, max-age=0, must-revalidate
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
cf-ray
854cd805fc563148-MAD
x-pushplatformapp-params
lmdzxr03ek
event.trk-consulatu.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-consulatu.com/register/event_log/lmdzxr03ek
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.111.3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://nngcu.speedoffered.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-expose-headers
Authorization, Link, X-Total-Count, X-pushPlatformApp-alert, X-pushPlatformApp-error, X-pushPlatformApp-params
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400
cache-control
no-cache, no-store, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
854cd804499d3148-MAD
content-length
0
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src * 'self' https://* blob: data:; font-src 'self' data:
date
Tue, 13 Feb 2024 11:48:42 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0quFuVGZwLat3B3Q3BYTHiwwUsCVbIXEp%2BpJyXuXUj10Aol8uGltV05efHyJl1rTeTRbPR4kd9qEnW0AtNAj4zE3YGMNAtrNhZ%2BjFeYQt15KEUQWZm2vt3a%2BVt3wOebmLdJetGYLvQf4vA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| setClass function| transform object| Alpine function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore

3 Cookies

Domain/Path Name / Value
pompousposterity.com/ Name: uid45
Value: 1410390306-20240213064832-dc334be24bea215196c5c92058a9a865-
nngcu.connectmyoffers.com/ Name: yredir_session
Value: eyJpdiI6InltSitEQTVTUGNyRXpGZkI2NFI3ZXc9PSIsInZhbHVlIjoiRXhvYWQyVTBHZmtlbW5WVnNpRWJqYkMxRlNOc2lLSzg2MDNIZjhCM1BSZ3duUGN2b2g4Ky9oVE9icTZUQ0NKTHhYRDdjcDF1c2d3WEtWVXVyMXV0ZTBHK2JrWlZVOTZPT0d6a3IyUmFmN3ZpS00zYXA1WWhrK2o2ZlZ0T2VLbjkiLCJtYWMiOiJjNDc1YTNiN2UyNDhmNDE1NzJjZjc2MGY0NGQ3YTNmNTg4OTcwZDA1MGMzMWE2ZWYyNDg1Njc5MTJkODYyOTAzIiwidGFnIjoiIn0%3D
nngcu.speedoffered.com/ Name: yredir_session
Value: eyJpdiI6IlRJZ1ExRmF6SjJKQnFwT3U5ZXNLdEE9PSIsInZhbHVlIjoiV04rNVkxL0xuUkhUdE55T1NqOUpDZGw2dHVscThUWmJFd0lleFA3VnoyaWdsclFDUUdNSUNZME1iRjYvZmVnNCthNi9xbDh3a2xKZTJHUnJZd3pkdHhYUVdFRURrOFRQZEEvVkV6Uk9KcWNkVytaaXQxQ2pCMVExVHFYenY1ZDQiLCJtYWMiOiI1MTE4MzNlYzQ4MDFhM2Y5ZGNmYWQ0ZGE5NzI3ZDhlOTE2Y2NmM2UwZWMwZjE1Y2JmOThhMDNjZmU1NDU4MjkxIiwidGFnIjoiIn0%3D

1 Console Messages

Source Level URL
Text
other error URL: https://nngcu.speedoffered.com/t/9aa1b3eb815f/d27e1484-ca65-11ee-a129-435fbc69d3db/d2879414-ca65-11ee-bdd4-c702cd99f5aa
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.