Submitted URL: http://switchlower.me/
Effective URL: https://switchlower.me/
Submission: On May 07 via manual from US

Summary

This website contacted 22 IPs in 6 countries across 17 domains to perform 64 HTTP transactions. The main IP is 2606:4700:3036::6815:313b, located in United States and belongs to CLOUDFLARENET, US. The main domain is switchlower.me.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 22nd 2020. Valid for: a year.
This is the only time switchlower.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 22 2606:4700:303... 13335 (CLOUDFLAR...)
6 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 3 52.30.135.179 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
3 13.248.219.41 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
7 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 34.250.160.147 16509 (AMAZON-02)
3 15.237.76.117 16509 (AMAZON-02)
1 1 34.255.166.243 16509 (AMAZON-02)
1 34.251.77.56 16509 (AMAZON-02)
1 3 172.217.16.134 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 3 2a00:1450:400... 15169 (GOOGLE)
1 172.217.23.98 15169 (GOOGLE)
2 2a03:2880:f00... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f10... 32934 (FACEBOOK)
64 22
Domain Requested by
22 switchlower.me 1 redirects switchlower.me
7 bat.bing.com switchlower.me
bat.bing.com
2992003.fls.doubleclick.net
6 assets.adobedtm.com assets.adobedtm.com
3 2992003.fls.doubleclick.net 1 redirects www.googletagmanager.com
adservice.google.com
3 sadobeanalytics.geico.com assets.adobedtm.com
switchlower.me
3 geico.chat.digital.ringcentral.com switchlower.me
geico.chat.digital.ringcentral.com
3 dpm.demdex.net 1 redirects switchlower.me
2 www.facebook.com 2992003.fls.doubleclick.net
2 connect.facebook.net 2992003.fls.doubleclick.net
connect.facebook.net
2 www.google.de switchlower.me
2992003.fls.doubleclick.net
2 www.google.com switchlower.me
2992003.fls.doubleclick.net
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 www.googletagmanager.com assets.adobedtm.com
www.googletagmanager.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 www.googleadservices.com 2992003.fls.doubleclick.net
1 adservice.google.de 1 redirects
1 adservice.google.com 2992003.fls.doubleclick.net
1 stats.g.doubleclick.net www.google-analytics.com
1 geico.tt.omtrdc.net assets.adobedtm.com
1 cm.everesttech.net 1 redirects
1 geico.demdex.net assets.adobedtm.com
1 c.go-mpulse.net s.go-mpulse.net
1 s.go-mpulse.net switchlower.me
64 23
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-06-22 -
2021-06-22
a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1
2021-01-08 -
2021-09-30
9 months crt.sh
akstat.io
DigiCert Secure Site ECC CA-1
2020-05-06 -
2021-08-05
a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1
2020-12-02 -
2022-01-02
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2021-04-13 -
2021-07-06
3 months crt.sh
digital.ringcentral.com
Amazon
2020-09-16 -
2021-10-18
a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01
2021-04-12 -
2021-10-12
6 months crt.sh
sadobeanalytics.geico.com
DigiCert SHA2 High Assurance Server CA
2020-04-13 -
2021-07-16
a year crt.sh
*.tt.omtrdc.net
DigiCert SHA2 Secure Server CA
2020-11-02 -
2021-11-09
a year crt.sh
*.google.com
GTS CA 1O1
2021-04-13 -
2021-07-06
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2021-04-13 -
2021-07-06
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-04-13 -
2021-07-06
3 months crt.sh
www.google.com
GTS CA 1C3
2021-04-13 -
2021-07-06
3 months crt.sh
www.google.de
GTS CA 1C3
2021-04-13 -
2021-07-06
3 months crt.sh
www.googleadservices.com
GTS CA 1C3
2021-04-13 -
2021-07-06
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-04-06 -
2021-07-03
3 months crt.sh

This page contains 6 frames:

Primary Page: https://switchlower.me/
Frame ID: 1599D41FFC46810F971455622E07BA20
Requests: 48 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/LBAJ4-7RCLK-J6VHB-MN55E-J4AYH
Frame ID: CD2CFF1F6713DA29CD24C7488C4D63B5
Requests: 2 HTTP requests in this frame

Frame: https://geico.demdex.net/dest5.html?d_nsid=0
Frame ID: 7ECA0287CEEAA4898E6EC703A955D976
Requests: 1 HTTP requests in this frame

Frame: https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Frame ID: B8E53DEACB13F72136392541A08A3433
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Frame ID: 482E9BDABD194C04CFABFE908A522546
Requests: 1 HTTP requests in this frame

Frame: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Frame ID: BDC58DA9B5B308A772E3C57C726DCA32
Requests: 12 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://switchlower.me/ HTTP 301
    https://switchlower.me/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /\/\/assets.adobedtm.com\//i

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

64
Requests

100 %
HTTPS

64 %
IPv6

17
Domains

23
Subdomains

22
IPs

6
Countries

900 kB
Transfer

3219 kB
Size

16
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://switchlower.me/ HTTP 301
    https://switchlower.me/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20
  • https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347
Request Chain 35
  • https://cm.everesttech.net/cm/dd?d_uuid=80437627143179642533706993118307813721 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u
Request Chain 38
  • https://2992003.fls.doubleclick.net/activityi;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F HTTP 302
  • https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Request Chain 46
  • https://adservice.google.de/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F HTTP 302
  • https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F

64 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
switchlower.me/
Redirect Chain
  • http://switchlower.me/
  • https://switchlower.me/
97 KB
17 KB
Document
General
Full URL
https://switchlower.me/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c16083359eec24e8fecdd8bfed214525be923db82ef853b5cd5d9105f5361254
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
switchlower.me
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:04 GMT
content-type
text/html; charset=UTF-8
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-frame-options
sameorigin
content-security-policy
frame-ancestors 'self'
link
<https://assets.adobedtm.com>; rel=preconnect <https://www.googletagmanager.com>; rel=preconnect <https://dpm.demdex.net>; rel=preconnect <https://vt.myvisualiq.net>; rel=preconnect <https://t.myvisualiq.net>; rel=preconnect <https://p.tvpixel.com>; rel=preconnect <https://d.turn.com>; rel=preconnect <https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js>; rel=preload; as=script
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-cdn
Imperva
x-iinfo
5-27347399-27356022 SNNN RT(1620408343996 140137) q(0 0 0 -1) r(1 1) U5
x-akamai-transformed
9 17568 0 pmb=mRUM,2
expires
Fri, 07 May 2021 17:28:04 GMT
cache-control
max-age=0, no-cache, no-store
pragma
no-cache
set-cookie
visid_incap_1684653=k8Ka49AeQZyIFqFW/xycXqR4lWAAAAAAQUIPAAAAAAAdzxewh2ZXfj9yPUojuPJJ; expires=Sat, 07 May 2022 09:32:47 GMT; HttpOnly; path=/; Domain=.geico.com; Secure; SameSite=None incap_ses_875_1684653=prt5av7cFnJf7+bO/Z8kDKR4lWAAAAAA7FIqFnWtEyVQUfREWwN/3w==; path=/; Domain=.geico.com; Secure; SameSite=None
server-timing
edge; dur=4 origin; dur=148 cdn-cache; desc=MISS
cf-cache-status
DYNAMIC
cf-request-id
09e9785aef000006319b124000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=feB%2BTfn%2FXV4HdnCqByfNIexi7jUQd36o9SFO9nJzw0GY62cjl56jvSroX09Q2JYBe6VlHHVYxPTM7uUoOeUxN0Zi5Gtlc0BvJtvfJ63mztvx54OWdZQiRR%2F1PA%3D%3D"}],"group":"cf-nel"}
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
cf-ray
64bc29a4be1b0631-FRA
content-encoding
br
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date
Fri, 07 May 2021 17:28:04 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; expires=Sun, 06-Jun-21 17:28:04 GMT; path=/; domain=.switchlower.me; HttpOnly; SameSite=Lax
Location
https://switchlower.me/
CF-Cache-Status
DYNAMIC
cf-request-id
09e9785a5f00004edf1b1f3000000001
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3o0B7Ve25tp7l3aVVb9sBVwfXbnrqg0JyMTlTmtaQtGDDJ9COutQ7j4yTf9eC6iP50VjgSpbkDoWmDfukSfo2rtzY8Uf%2BHFlFwwznAqrp%2FQISWvBk3AojD5snw%3D%3D"}],"max_age":604800,"group":"cf-nel"}
NEL
{"max_age":604800,"report_to":"cf-nel"}
Server
cloudflare
CF-RAY
64bc29a3cf9b4edf-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
assets.adobedtm.com/
355 KB
96 KB
Script
General
Full URL
https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
7812342c0b0cbd5d699200f898538345f1ff23516280121e9916e1fc915b0770

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:04 GMT
content-encoding
gzip
last-modified
Fri, 07 May 2021 16:00:53 GMT
server
AkamaiNetStorage
etag
"17bc2f81777082a70ca78c561e1d3829:1620403253.91403"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://switchlower.me
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 07 May 2021 18:28:04 GMT
cache-base-css.php
switchlower.me/public/css/design6/
263 KB
33 KB
Stylesheet
General
Full URL
https://switchlower.me/public/css/design6/cache-base-css.php
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6b19992ce19edffbf47e2e0e2700e15779ab8c0961b4375b3473a6d97267bb1
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/css/design6/cache-base-css.php
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:04 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
2-8125975-8125976 NNNN CT(89 91 0) RT(1620384759346 1) q(0 0 2 0) r(3 3) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09e9785be600003237a1335000000001
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6WgTFjocBJCKeNL0T3jx1CQQlCeRyhljurgpK4DfOXpF4ycKSwBuyURjNE%2B7Ehmxf3ahbYXLVRSh637b5S5qEebl3laa%2FLvLwmqjTP20CYBO5hlnXEwBa0O8XQ%3D%3D"}]}
content-type
text/css;charset=UTF-8
x-xss-protection
1; mode=block
cache-control
max-age=3600
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a6396b3237-FRA
geico.com.css
switchlower.me/public/css/design6/
29 KB
6 KB
Stylesheet
General
Full URL
https://switchlower.me/public/css/design6/geico.com.css
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3394c09a692efd1a3d777125b9802b11582b53ff86390951b47f526a0c9baa04
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/css/design6/geico.com.css
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:04 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
12-118103248-118103256 SNNN RT(1620384757095 9971) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
cf-request-id
09e9785be7000032377f87c000000001
last-modified
Fri, 07 May 2021 10:55:43 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nDDcS3i8nTk93EatzHNpDMyK9BK%2BaW11dDIGxj%2FvOXnO1AoGGzyceJA22OneegxQv9uI3XYQL3r0mwsql8b%2ByRNxNoLziwz2iAYKXENxHbwqlelGD0QWohp4Cw%3D%3D"}]}
content-type
text/css
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a639753237-FRA
main.css
switchlower.me/public/css/homepage/design6/
44 KB
8 KB
Stylesheet
General
Full URL
https://switchlower.me/public/css/homepage/design6/main.css
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d0b5bd193c90a7a7137fa4b7243191e88ab993ec428fd7112bc4bad5da49267
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/css/homepage/design6/main.css
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:04 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
3-34323670-34323672 NNNN CT(30 33 0) RT(1620384758268 8) q(0 0 1 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
cf-request-id
09e9785be700003237ee2a1000000001
last-modified
Fri, 07 May 2021 10:55:35 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9SlLL92veVGChmEb2PSS4pme1%2FkACnljUCwiKYq%2Fpe06q2DQ0fTql0i5mzRcXcEV5ipw%2BMK9S3MkOprQ06cyxk3bgJ8gQSrtX4QGqboLQ%2B5oX9ryaipPALE7Dg%3D%3D"}]}
content-type
text/css
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a639733237-FRA
gecko-side.jpg
switchlower.me/public/layout_images/homepage/design6/
12 KB
12 KB
Image
General
Full URL
https://switchlower.me/public/layout_images/homepage/design6/gecko-side.jpg
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
efb304a59575d781637c1129287d5b5ad03937c584953e24167266370f015387
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/layout_images/homepage/design6/gecko-side.jpg
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
14-36138804-36138805 PNNN RT(1620384750561 9400) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
content-length
11797
cf-request-id
09e9785ca9000032377f88f000000001
last-modified
Thu, 06 May 2021 14:01:29 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PkhuLbdusLQ20twYkHlImqfrshsi5CeEFdFAoY0xxYxKROlnIRXcYJhOGNKVT2lalAOnT362ZNxjRlIAmeSqhx2xzJSjgHwMPNK9NiUA7cIqeChaOE8ndVtP4Q%3D%3D"}]}
content-type
image/jpeg
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
cf-ray
64bc29a76c1c3237-FRA
ranked-1.png
switchlower.me/public/layout_images/homepage/design6/jdpower/
2 KB
3 KB
Image
General
Full URL
https://switchlower.me/public/layout_images/homepage/design6/jdpower/ranked-1.png
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02515ee3f986616cc4c0002e575e48e18590e77869a3a3d2d60136bb45a49c6b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/layout_images/homepage/design6/jdpower/ranked-1.png
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
13-36486035-36561323 SNNN RT(1620384559511 275604) q(0 0 0 1) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
content-length
2538
cf-request-id
09e9785ca600003237c6a94000000001
last-modified
Thu, 06 May 2021 14:01:29 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Czg3eG00NeLnCs92pGxXZTEuzlh7kvJfqOhh1qBqHVh3H%2F6dJcwbyCY%2BcfM6YTGptdPxL0JRSN9lzs3mAoUR%2FqZfPMo%2FGUU67RFyNF9cLmzMeDRSnwDmL%2FE1Iw%3D%3D"}]}
content-type
image/png
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
cf-ray
64bc29a76c1e3237-FRA
jdpower.png
switchlower.me/public/layout_images/homepage/design6/jdpower/
43 KB
43 KB
Image
General
Full URL
https://switchlower.me/public/layout_images/homepage/design6/jdpower/jdpower.png
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3f2c447994284b8fceb218aea1be93ed8640335ce15eb100188a5cb52179970
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/layout_images/homepage/design6/jdpower/jdpower.png
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
9-39219011-39258232 SNNN RT(1620384592584 425493) q(0 0 0 -1) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
content-length
43523
cf-request-id
09e9785ca600003237cdac3000000001
last-modified
Thu, 06 May 2021 14:01:29 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lO7bYlUQSVd1%2BdqrM6p4Vmk4ykIzyoPLDpSVd6nVTyW13%2B9JXN6LLjEx05A7RALU7mmXxpeHeSpkMRvOeXWw7y1dPER3p%2FmVfSv7qx1go4OZ%2B%2B3OY%2BJACDlaLQ%3D%3D"}]}
content-type
image/png
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
cf-ray
64bc29a76c233237-FRA
geicoApp-AppStoreDL.jpg
switchlower.me/public/images/aboutgeico/mobile/
3 KB
4 KB
Image
General
Full URL
https://switchlower.me/public/images/aboutgeico/mobile/geicoApp-AppStoreDL.jpg
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98cf2519495224f38de05c45472bed5960643518e8dfd8aceee77bd3701f872c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/images/aboutgeico/mobile/geicoApp-AppStoreDL.jpg
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
4-38994025-38994026 SNNN RT(1620384703929 55449) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
content-length
3100
cf-request-id
09e9785ca700003237cd084000000001
last-modified
Fri, 07 May 2021 10:49:38 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UleAYl%2BOK3eJDk2FBaGa6WQo9fZkhMzACXy5rvZ8YsT7%2BMfViQa0%2F7XBkCNhH2gFYHR8VkQe3nTmuAEx0KcnVqeaDkN3uWh1hqJ0gULWWvZ8gN7fEmUW6xDNkA%3D%3D"}]}
content-type
image/jpeg
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
cf-ray
64bc29a76c263237-FRA
geicoApp-GooglePlayDL.jpg
switchlower.me/public/images/aboutgeico/mobile/
3 KB
4 KB
Image
General
Full URL
https://switchlower.me/public/images/aboutgeico/mobile/geicoApp-GooglePlayDL.jpg
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d79217c6457a51cac79e8b968475030bd8b7e8de9d86b00f061233ff37871177
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/images/aboutgeico/mobile/geicoApp-GooglePlayDL.jpg
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
10-45587347-45606676 SNNN RT(1620384599954 159429) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
content-length
2878
cf-request-id
09e9785ca700003237e93c5000000001
last-modified
Fri, 07 May 2021 10:49:38 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mJ1fxXI6peWMBJUC6gGldduV7HiaOhqeJtE2v2fdPhKdidqOo3GJY%2FmOf8LIqykRs6MgcKr07cf5ZkWcEJm2ILcKIhwzOHxvFx2WCUoZBCY6aV6v7o7gQnd2LQ%3D%3D"}]}
content-type
image/jpeg
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
accept-ranges
bytes
cf-ray
64bc29a76c283237-FRA
email-decode.min.js
switchlower.me/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://switchlower.me/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

:path
/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"cf-nel","max_age":604800}
cf-request-id
09e9785c3d00003237be019000000001
last-modified
Fri, 30 Apr 2021 09:06:15 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"608bc887-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gF0xKbaVXqUfW3xF5RlCEIHuR8GMXPiq03gCCR0YUpODO7WPgTG%2BoNNsWeBraSlvkG2MOjGuxiBwVe5CjTCOGwzggCz2WcGhX6v%2FiHOg%2FbN1JEV%2BHPDR7gdp6w%3D%3D"}]}
content-type
application/javascript
cache-control
max-age=172800 public
cf-ray
64bc29a6ca953237-FRA
expires
Sun, 09 May 2021 17:28:04 GMT
cache-base-js.php
switchlower.me/public/scripts/design6/
450 KB
81 KB
Script
General
Full URL
https://switchlower.me/public/scripts/design6/cache-base-js.php
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3bf5254dbd435444aae1d45cdcdbf10cec495b78b8d752a1acc5c1b566d97632
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/scripts/design6/cache-base-js.php
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
10-14316599-14358084 SNNN RT(1620384421417 337740) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
09e9785c8f00003237e93c3000000001
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MVN8FQBqCptmLxOK8aRsvqgCNbGeghO0TP4ggtbSZLUGZuWVkO4uepx%2B%2BoDk96xfoGzCkePspAAtqWyc7R9mr22BiPEKhIBgKXa5jYP9dB5VzoflsMJFVAPIFw%3D%3D"}]}
content-type
application/javascript
x-xss-protection
1; mode=block
cache-control
max-age=3600
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a74bbc3237-FRA
jquery.cookie.js
switchlower.me/public/scripts/jquery/
4 KB
2 KB
Script
General
Full URL
https://switchlower.me/public/scripts/jquery/jquery.cookie.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f6a9c99d36c51fabdd3e290c6a7fafb8252e6f34627d37d133ee9381a7880e5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/scripts/jquery/jquery.cookie.js
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
12-33908453-33908454 SNNN RT(1620384756492 2102) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
cf-request-id
09e9785ca500003237f8b29000000001
last-modified
Fri, 07 May 2021 10:54:51 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=om71NFuBbCa6%2BBkOz4gJ6yr07FAgvdLYBMD3sfsVc7CxrzB0dH1wueH36ziUI%2Fix39HvoDp4mMf1NPSmtZV29kVBcw0R1daGciYIufY2sOOebIZK%2Fsmjc3P%2BGw%3D%3D"}]}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a76c0d3237-FRA
global.js
switchlower.me/public/scripts/design6/
55 KB
11 KB
Script
General
Full URL
https://switchlower.me/public/scripts/design6/global.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
35356a15f7cd1664f1da8ae6e5d0cd6e573a25b40c5e7c9ea31aa69e93a8b1e3
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/scripts/design6/global.js
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
13-144161137-144161107 PNNN RT(1620384758725 60) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=2
vary
Accept-Encoding
cf-request-id
09e9785ca40000323701a88000000001
last-modified
Fri, 07 May 2021 10:55:55 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JPAhPv2nm1ZiSgelpRMwg18eULgIXx139Q4N7kA8NNzI0X0SMsaY6H466dhdUpbVKZqtfte%2B6UsPbWkYibgwuInLdehcZj4bjqDgCJCYVxFjjzKcdNc1bMdS8A%3D%3D"}]}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a76c123237-FRA
homepage.js
switchlower.me/public/scripts/design6/
49 KB
8 KB
Script
General
Full URL
https://switchlower.me/public/scripts/design6/homepage.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9d7f13a127f5e543f983ffa8c106b7e708c20a6ddfbf205d2cd0178e8572a3cb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/scripts/design6/homepage.js
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
10-2361346-2361347 SNNN RT(1620384757534 21951) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=3
vary
Accept-Encoding
cf-request-id
09e9785ca500003237a7968000000001
last-modified
Fri, 07 May 2021 10:54:22 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xuFw8YejvTSNSTfgkrmS81ZPVzNXyhOSlhph32EELAjn1hqrOnj1%2FyHm%2FR8EX4eCHAV87NP1kiTKGseHXtWlewQpYBpXbEmigaMwJPMPwM0Adp9wzvM7ib5mhw%3D%3D"}]}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a76c153237-FRA
getMethod.js
switchlower.me/public/scripts/
653 B
1 KB
Script
General
Full URL
https://switchlower.me/public/scripts/getMethod.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e02c6c70d246d353fc47a1ed35d6dd3214bcc536e8b695f86c386d9d52423de5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/scripts/getMethod.js
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
12-130046669-130046676 NNNN CT(49 55 0) RT(1620384759049 44) q(0 0 2 2) r(2 2) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
cf-request-id
09e9785ca800003237f8b2a000000001
last-modified
Fri, 07 May 2021 10:56:02 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4uq%2BqQuVCjFr8gyn4hfDrBKaYEPKfeQUVvZWHz1B3D8fE0oW8CUBMk87iuAle9hlyyvvQCNhzDWcCCckMh%2FSAnPZw14Bw58%2BYkCMah6I6UR2EbrE4zd8tIxSkQ%3D%3D"}]}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a76c193237-FRA
LBAJ4-7RCLK-J6VHB-MN55E-J4AYH
s.go-mpulse.net/boomerang/ Frame CD2C
202 KB
51 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/LBAJ4-7RCLK-J6VHB-MN55E-J4AYH
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:287::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
last-modified
Sat, 24 Apr 2021 13:32:13 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
timing-allow-origin
*
content-length
51580
truncated
/
42 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
lato-normal-400-latin.woff2
switchlower.me/public/design-kit/4.0/fonts/
26 KB
26 KB
Font
General
Full URL
https://switchlower.me/public/design-kit/4.0/fonts/lato-normal-400-latin.woff2
Requested by
Host: switchlower.me
URL: https://switchlower.me/public/css/design6/cache-base-css.php
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47a3e3b64cffe3ff820ebe554ac4df940da5ed469eaddbbc13bdd3b0b1eb4479
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://switchlower.me
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
font
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
:path
/public/design-kit/4.0/fonts/lato-normal-400-latin.woff2
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
switchlower.me
referer
https://switchlower.me/public/css/design6/cache-base-css.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://switchlower.me
Referer
https://switchlower.me/public/css/design6/cache-base-css.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
8-7512807-7523848 SNNN RT(1620384599330 182849) q(0 0 0 2) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=5
vary
Accept-Encoding
content-length
26144
x-xss-protection
1; mode=block
last-modified
Thu, 06 May 2021 14:01:29 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=S4cqnLqefPv5A1vDOct%2FY8pAgpKJLGZtKQUPbFMZ6RGan2udxTnJXi4%2F24J60JqCoSEBrX1e68g%2Fusd9lVJ%2F9I9AaPOAZmlQTh87LaMc5FdOihpb3XbtgLg41A%3D%3D"}]}
content-type
font/woff2
access-control-allow-origin
*
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-request-id
09e9785cab00003237b11bf000000001
accept-ranges
bytes
cf-ray
64bc29a77c313237-FRA
geico.ttf
switchlower.me/public/design-kit/4.0/fonts/
82 KB
47 KB
Font
General
Full URL
https://switchlower.me/public/design-kit/4.0/fonts/geico.ttf?r5709x
Requested by
Host: switchlower.me
URL: https://switchlower.me/public/css/design6/cache-base-css.php
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a6135d6c9e52110c5bebdc942bc27c30004ef47f5bc05f390212a35da68c3ad5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://switchlower.me
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
font
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
:path
/public/design-kit/4.0/fonts/geico.ttf?r5709x
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
switchlower.me
referer
https://switchlower.me/public/css/design6/cache-base-css.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://switchlower.me
Referer
https://switchlower.me/public/css/design6/cache-base-css.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
9-17797948-17797949 SNNN RT(1620384787864 10226) q(0 0 0 0) r(2 2) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
cf-request-id
09e9785cb200003237ef264000000001
last-modified
Thu, 06 May 2021 14:01:29 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=56kozXfy263UrsEVR%2F%2BcRe3RtJP3LHeDs1H%2FWnruHyS4gaagA8rvbths5jDgIU9mt80so6UqMfgOH%2FGyXNOcglCb3SoIo2GZ48psWp3sNUekqCex%2FS1%2Br01tNA%3D%3D"}]}
content-type
font/ttf
access-control-allow-origin
*
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29a78c4b3237-FRA
lato-normal-700-latin.woff2
switchlower.me/public/design-kit/4.0/fonts/
25 KB
26 KB
Font
General
Full URL
https://switchlower.me/public/design-kit/4.0/fonts/lato-normal-700-latin.woff2
Requested by
Host: switchlower.me
URL: https://switchlower.me/public/css/design6/cache-base-css.php
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63413259cbaefb160e5ade88d65669a85beb447007edb1eb6f58daeba865822e
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
origin
https://switchlower.me
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
font
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
:path
/public/design-kit/4.0/fonts/lato-normal-700-latin.woff2
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
switchlower.me
referer
https://switchlower.me/public/css/design6/cache-base-css.php
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://switchlower.me
Referer
https://switchlower.me/public/css/design6/cache-base-css.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
14-43714866-43714868 SNNN RT(1620384707041 82166) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
content-length
25604
x-xss-protection
1; mode=block
last-modified
Thu, 06 May 2021 14:01:29 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=euienv%2Bi2n%2BR5iAzdQ9aZLLtHuvIpV7u1uc94b1V2iFg0SN6baF5ytQrZsDhoRDYWjelsWBEBlC5Q68nw6WGwnZ5Fs1i6W5A0U%2BORibTCrpQIxTbKyOPOKvqzw%3D%3D"}]}
content-type
font/woff2
access-control-allow-origin
*
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-request-id
09e9785cb300003237d4b24000000001
accept-ranges
bytes
cf-ray
64bc29a78c4d3237-FRA
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347
  • https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347
364 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.135.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-135-179.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
bcd6d6544b04396263538bcbdc14c305491cf039b8f0a1e826601964597c26d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v005-039530b64.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
zoOIf65MSDw=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://switchlower.me
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
308
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v005-02a349794.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://switchlower.me
X-TID
PSRg6qpNRy4=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
AppMeasurement.min.js
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/
33 KB
12 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
last-modified
Wed, 12 Aug 2020 22:09:52 GMT
server
AkamaiNetStorage
etag
"f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://switchlower.me
cache-control
no-cache
accept-ranges
bytes
timing-allow-origin
*
content-length
12184
expires
Fri, 07 May 2021 18:28:05 GMT
js
www.googletagmanager.com/gtag/
88 KB
35 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-34118221-1&l=dataLayer
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
50e2012d10fecd1d38c717dc5d3d4f6023dbc57808e366073a2b200186c170d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35807
x-xss-protection
0
last-modified
Fri, 07 May 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 07 May 2021 17:28:05 GMT
RCd3ddf95ceb1f42d89ad6930803f05061-source.min.js
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/
544 B
602 B
Script
General
Full URL
https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RCd3ddf95ceb1f42d89ad6930803f05061-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
395f845728799f09f018fed5c842d831286a819584253df9e588d8ad733a32b0

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
last-modified
Fri, 07 May 2021 16:00:54 GMT
server
AkamaiNetStorage
etag
"8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://switchlower.me
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
337
expires
Fri, 07 May 2021 18:28:05 GMT
florida-zipcodes.js
switchlower.me/public/scripts/
26 KB
4 KB
Script
General
Full URL
https://switchlower.me/public/scripts/florida-zipcodes.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/public/scripts/design6/global.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4942742285c81ae389c8e777cf0863a46ad8d2e3c64d97ee500a4529290e4927
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/scripts/florida-zipcodes.js
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; AMCV_71FF20B3534568190A490D45%40AdobeOrg=-1124106680%7CMCIDTS%7C18755%7CvVersion%7C5.2.0; mbox=session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346; at_check=true; RT="z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
8-30667403-30668094 NNNN CT(46 48 0) RT(1620384790630 69903) q(0 0 1 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=6
vary
Accept-Encoding
cf-request-id
09e9785e7c00003237ef292000000001
last-modified
Fri, 07 May 2021 10:54:22 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tsFDsIwNOPiDQ7k5gvhVHvAYy1lx%2BdwTS5TXM9i3djgg9%2FSl%2FfdwTS2hkctgtzwhz5COn7PAxgA0yhBYHIEyoey23ZQtKVpnIedP%2BNAxsYNuurBhQjc%2FklLKIA%3D%3D"}]}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29aa5a613237-FRA
geolocation.js
switchlower.me/public/scripts/
3 KB
2 KB
XHR
General
Full URL
https://switchlower.me/public/scripts/geolocation.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/public/scripts/design6/cache-base-js.php
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
926c2f23ee30acb05d85b0f176a502e86d4d767ed750ed35efe2787fb5e52847
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-fetch-mode
cors
accept-encoding
gzip, deflate, br
accept-language
en-US
x-requested-with
XMLHttpRequest
sec-fetch-dest
empty
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; AMCV_71FF20B3534568190A490D45%40AdobeOrg=-1124106680%7CMCIDTS%7C18755%7CvVersion%7C5.2.0; mbox=session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346; at_check=true; RT="z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"
:path
/public/scripts/geolocation.js
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept
*/*
Referer
https://switchlower.me/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
14-86228770-87249984 NNNN CT(46 46 0) RT(1620378458723 6407135) q(0 0 1 0) r(2 2) U5
server-timing
cdn-cache; desc=HIT edge; dur=16
vary
Accept-Encoding
cf-request-id
09e9785e8e0000323780253000000001
last-modified
Fri, 07 May 2021 10:54:27 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Tm19bCHwIaAQVVI3QTOrjpWVPvOv%2FGk6%2FljnfRr0LkTa4%2FbGARXEsvuT5Z5dtFgyzId%2BAFAIWTKD%2BxO38XLu2UpPIKLsdliOaoj6atUaSX3p8X%2BTD%2B5aNBD4vA%3D%3D"}]}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29aa7aa23237-FRA
loader.js
geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/
36 KB
8 KB
Script
General
Full URL
https://geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/loader.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.219.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
aa36da1a4932b324f.awsglobalaccelerator.com
Software
/
Resource Hash
2eff1ef7b6768e5f7b659875e3b8d8c426e2446005fb79e10446412403ad45a5
Security Headers
Name Value
Strict-Transport-Security max-age=31556952; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
access-control-max-age
1728000
strict-transport-security
max-age=31556952; includeSubDomains
x-xss-protection
1; mode=block
x-request-id
52b0b520b448ffe17ece65d81eb63dc4
x-runtime
0.011146
x-rp-cache
HIT
referrer-policy
strict-origin-when-cross-origin
x-frame-options
SAMEORIGIN
etag
W/"2eff1ef7b6768e5f7b659875e3b8d8c4"
x-download-options
noopen
vary
Accept-Encoding
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=300, public
permissions-policy
camera=(), geolocation=(), microphone=()
access-control-allow-headers
Accept, Accept-Encoding, Content-Description, Content-Disposition, Content-Range, Content-Type, Origin, X-Requested-With
expires
Fri, 07 May 2021 17:32:29 GMT
RC425b403428db4589a020193bcf2cc140-source.min.js
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/
2 KB
991 B
Script
General
Full URL
https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RC425b403428db4589a020193bcf2cc140-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
fac4c46db204bd889e464a6f0eafb1dc763961700bbd4441578acea61d1c46aa

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
last-modified
Fri, 07 May 2021 16:00:54 GMT
server
AkamaiNetStorage
etag
"8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://switchlower.me
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
726
expires
Fri, 07 May 2021 18:28:05 GMT
RC4b6623536c3243b7858959f2e7af14d9-source.min.js
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/
1 KB
901 B
Script
General
Full URL
https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RC4b6623536c3243b7858959f2e7af14d9-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
83d8ecff1ddd5c63be5338ca0a1130a3009f4a581217407c7eb5960b591420de

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
last-modified
Fri, 07 May 2021 16:00:54 GMT
server
AkamaiNetStorage
etag
"8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://switchlower.me
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
636
expires
Fri, 07 May 2021 18:28:05 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-34118221-1&l=dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Apr 2021 23:59:54 GMT
server
Golfe2
age
3673
date
Fri, 07 May 2021 16:26:52 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19569
expires
Fri, 07 May 2021 18:26:52 GMT
js
www.googletagmanager.com/gtag/
81 KB
33 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-2992003&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-34118221-1&l=dataLayer
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b42d9140930e69978c71b2f4637a72c3c715584552be9ad78f3b8328273dca1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33298
x-xss-protection
0
last-modified
Fri, 07 May 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 07 May 2021 17:28:05 GMT
bat.js
bat.bing.com/
30 KB
9 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3183481f09352eade87e53d32ac3c1f6ab5b853e2b5bde4035834680b53d9299

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
last-modified
Tue, 13 Apr 2021 17:21:02 GMT
x-msedge-ref
Ref A: FF84CD9AA93645AC96CC43E259C7C8C4 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
etag
"0d398608930d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
8910
config.json
c.go-mpulse.net/api/ Frame CD2C
68 B
346 B
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=LBAJ4-7RCLK-J6VHB-MN55E-J4AYH&d=switchlower.me&t=5401362&v=1.632.0&if=&sl=0&si=lfn9h5wrlwr-qsqz6t&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=&ak.ai=294026
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/LBAJ4-7RCLK-J6VHB-MN55E-J4AYH
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:19a::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
3217a6955b600825965f424d1cf73bc156ade880bcb4e16760cfe1771e2da89e

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 07 May 2021 17:28:05 GMT
Cache-Control
public, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
68
Content-Type
application/json
dest5.html
geico.demdex.net/ Frame 7ECA
7 KB
3 KB
Document
General
Full URL
https://geico.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.250.160.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-250-160-147.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
geico.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://switchlower.me/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
demdex=80437627143179642533706993118307813721
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://switchlower.me/

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding
gzip
Content-Type
text/html;charset=UTF-8
date
Fri, 7 May 2021 17:28:05 GMT
DCS
dcs-prod-irl1-1-v005-04d937ff6.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Expires
Thu, 01 Jan 1970 00:00:00 UTC
last-modified
Thu, 22 Apr 2021 14:22:49 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
vary
accept-encoding
X-TID
rAB4gkjZTNw=
Content-Length
2791
Connection
keep-alive
id
sadobeanalytics.geico.com/
48 B
505 B
XHR
General
Full URL
https://sadobeanalytics.geico.com/id?d_visid_ver=5.2.0&d_fieldgroup=A&mcorgid=71FF20B3534568190A490D45%40AdobeOrg&mid=80541991993212901553681286375836860207&ts=1620408485597
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-76-117.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
693c0b99b3d10d845d4e23e4f49385f3ca54445d6d4ebb03f45d6c45fd0477a7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-76898875b9-f5dhx
vary
Origin
x-c
main-1461.Id0ac08.M0-490
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://switchlower.me
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript;charset=utf-8
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=80437627143179642533706993118307813721
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u
42 B
973 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.135.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-30-135-179.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v005-039fc829c.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
lnTgAH3/TgI=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u
Date
Fri, 07 May 2021 17:28:05 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
delivery
geico.tt.omtrdc.net/rest/v1/
278 B
505 B
XHR
General
Full URL
https://geico.tt.omtrdc.net/rest/v1/delivery?client=geico&sessionId=cae3fc0fd95b4e7cb9a840050ace94f5&version=2.4.0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.77.56 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-77-56.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8d58ae704ad171d099f8bfbf270baa32161974f8a598238f15301db25ec83f4a

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://switchlower.me
date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
access-control-allow-credentials
true
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
x-request-id
15f717b6fb1e9d826c3c5e7d92132067
content-type
application/json;charset=UTF-8
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j90&a=839458068&t=pageview&_s=1&dl=https%3A%2F%2Fswitchlower.me%2F&ul=en-us&de=UTF-8&dt=An%20Insurance%20Company%20For%20Your%20Car%20And%20More%20%7C%20GEICO&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=4GBAAUABAAAAAC~&jid=1355144418&gjid=2107529534&cid=596866999.1620408486&tid=UA-34118221-1&_gid=465509405.1620408486&_r=1&gtm=2ou4s0&cd1=ga%20pageview%20-%20page%20view&cd2=Static%3AHomePage%3ADefault&cd3=&cd5=&cd7=&cd9=&cd10=&cd11=&cd13=&cd14=unknown&cd16=&cd35=05%2F07%2F2021%2019%3A28%3A05&cd36=-2&cd37=&cd40=https%3A%2F%2Fswitchlower.me%2F&cd41=&cd42=&cd43=&cd44=False&cd45=&cd46=&cd49=&cd50=&cd52=&cd53=&cd54=&cd55=&cd56=&cd57=&cd58=&cd59=&cd60=&cd61=&cd62=&cd63=&cd64=&cd65=&cd67=&cd68=&cd69=&cd70=&cd71=&cd72=&cd73=&cd74=&cd75=&cd78=&cd79=English&cd80=Original&cd81=&cd82=&cd24=&cm8=&cm10=&cm11=&cm12=&cd19=&z=471954823
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://switchlower.me
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefaul...
2992003.fls.doubleclick.net/ Frame B8E5
Redirect Chain
  • https://2992003.fls.doubleclick.net/activityi;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefa...
  • https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u1...
557 B
459 B
Document
General
Full URL
https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-2992003&l=dataLayer&cx=c
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.134 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f6.1e100.net
Software
cafe /
Resource Hash
c61fd39ef07aabeb2f53fff7048f24fb331da3220ca05b48f5986e7621b37667
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
2992003.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://switchlower.me/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 07 May 2021 17:28:05 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
434
x-xss-protection
0
set-cookie
test_cookie=CheckForPermission; expires=Fri, 07-May-2021 17:43:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 07 May 2021 17:28:05 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
collect
stats.g.doubleclick.net/j/
4 B
87 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-34118221-1&cid=596866999.1620408486&jid=1355144418&gjid=2107529534&_gid=465509405.1620408486&_u=4GBAAUAAAAAAAC~&z=1354167291
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 07 May 2021 17:28:05 GMT
content-type
text/plain
access-control-allow-origin
https://switchlower.me
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
5118357
bat.bing.com/p/action/
0
126 B
Script
General
Full URL
https://bat.bing.com/p/action/5118357
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 07 May 2021 17:28:05 GMT
cache-control
private,max-age=86400
x-msedge-ref
Ref A: 9939298B5F144AF5B0B6A55DAA8DD714 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
x-powered-by
ARR/3.0
0
bat.bing.com/action/
0
148 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5118357&Ver=2&mid=6e0c8184-6b23-4320-9fd1-e633e9a5cc49&sid=954d3c30af5911eb8ece03e36c264b59&vid=954d5eb0af5911eba01669dc7f83441f&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=An%20Insurance%20Company%20For%20Your%20Car%20And%20More%20%7C%20GEICO&p=https%3A%2F%2Fswitchlower.me%2F&r=&lt=1061&evt=pageLoad&msclkid=N&sv=1&rn=79807
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Fri, 07 May 2021 17:28:05 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 4E54373379FA43C6853B9749DDFCA1B8 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/
0
94 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5118357&Ver=2&mid=6e0c8184-6b23-4320-9fd1-e633e9a5cc49&sid=954d3c30af5911eb8ece03e36c264b59&vid=954d5eb0af5911eba01669dc7f83441f&vids=0&ec=homepage&el=default&ev=1&ea=goal&en=Y&evt=custom&msclkid=N&rn=687238
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Fri, 07 May 2021 17:28:05 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: CF954FF1C8C84B618EA8165E3991CDBE Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-34118221-1&cid=596866999.1620408486&jid=1355144418&_u=4GBAAUAAAAAAAC~&z=103357014
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-34118221-1&cid=596866999.1620408486&jid=1355144418&_u=4GBAAUAAAAAAAC~&z=103357014
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;...
adservice.google.com/ddm/fls/i/ Frame 482E
556 B
503 B
Document
General
Full URL
https://adservice.google.com/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b2d645f512e2d3f262fe912bb745d171f1ffd5bc940064b6ac0a8f7f8a9e018a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
adservice.google.com
:scheme
https
:path
/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://2992003.fls.doubleclick.net/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://2992003.fls.doubleclick.net/

Response headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 07 May 2021 17:28:05 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
pragma
no-cache
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
433
x-xss-protection
0
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;...
2992003.fls.doubleclick.net/ddm/fls/r/ Frame BDC5
Redirect Chain
  • https://adservice.google.de/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u1...
  • https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u1...
2 KB
1 KB
Document
General
Full URL
https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Requested by
Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.134 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f6.1e100.net
Software
cafe /
Resource Hash
8795f3f4ee117ffdd061a733d2c514ec91df4fc24fa01d7304401da603a23b92
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
2992003.fls.doubleclick.net
:scheme
https
:path
/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://adservice.google.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://adservice.google.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 07 May 2021 17:28:05 GMT
expires
Fri, 07 May 2021 17:28:05 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
1308
x-xss-protection
0
set-cookie
IDE=AHWqTUnrqHLLpthz-9eDpoLJEOif3NClvnLGEX2dcAAd5aKx8_5LqJ94mae2rtulxT4; expires=Sun, 07-May-2023 17:28:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Fri, 07 May 2021 17:28:05 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
location
https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
s76002416697062
sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/
43 B
224 B
Image
General
Full URL
https://sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/s76002416697062?AQB=1&ndh=1&pf=1&t=7%2F4%2F2021%2019%3A28%3A5%205%20-120&sdid=0F49B76A6E83B638-4DA80CFCC7111E14&mid=80541991993212901553681286375836860207&aamlh=6&ce=UTF-8&ns=geico&pageName=Static%3AHomePage%3ADefault&g=https%3A%2F%2Fswitchlower.me%2F&cc=USD&events=event32&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c2=https%3A%2F%2Fswitchlower.me%2F&c5=2.22.0&c14=Non-Mobile%20App%20Experience&c15=v&v15=v&v16=%2B1&v18=Static%3AHomePage%3ADefault&v19=1%3A00PM-Friday&c21=spa%20update%20-%20load%20time%20not%20available&v21=Non-Mobile%20App%20Experience&c28=8.007.1_P&v33=spa%20update%20-%20load%20time%20not%20available&c48=dom%20ready%20page%20view&c50=English&v55=https%3A%2F%2Fswitchlower.me%2F&v74=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F89.0.4389.72%20Safari%2F537.36&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=71FF20B3534568190A490D45%40AdobeOrg&AQE=1
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-76-117.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
x-content-type-options
nosniff
x-c
main-1461.Id0ac08.M0-490
p3p
CP="This is not a P3P policy"
vary
*
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 08 May 2021 17:28:05 GMT
server
jag
xserver
anedge-76898875b9-qmj55
etag
3479800725144895488-4621827392094444478
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 06 May 2021 17:28:05 GMT
messaging-60e0faac6e7fc4e05ea22dc54f59253efa19d77cd18348db4a13ddfb05cfc701.js
geico.chat.digital.ringcentral.com/assets/
827 KB
202 KB
Script
General
Full URL
https://geico.chat.digital.ringcentral.com/assets/messaging-60e0faac6e7fc4e05ea22dc54f59253efa19d77cd18348db4a13ddfb05cfc701.js
Requested by
Host: geico.chat.digital.ringcentral.com
URL: https://geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.219.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
aa36da1a4932b324f.awsglobalaccelerator.com
Software
/
Resource Hash
2a04c92b65295ae102f2bcedbd8de8ee7c506a962a691de8f4afa0aa6ac21699

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
last-modified
Wed, 28 Apr 2021 10:27:15 GMT
etag
W/"60893883-ceb99"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
conversion.js
www.googleadservices.com/pagead/ Frame BDC5
43 KB
17 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s45-in-f2.1e100.net
Software
cafe /
Resource Hash
f2bc2b36ee0cdf606f492175e7694d827aff1c6fa5dcfcc2f6ca0eb9f031071f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16619
x-xss-protection
0
server
cafe
etag
9793835177489279883
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 07 May 2021 17:28:06 GMT
bat.js
bat.bing.com/ Frame BDC5
30 KB
9 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3183481f09352eade87e53d32ac3c1f6ab5b853e2b5bde4035834680b53d9299

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:05 GMT
content-encoding
gzip
last-modified
Tue, 13 Apr 2021 17:21:02 GMT
x-msedge-ref
Ref A: AC7446C8527D488AAF9452C983195EBA Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
etag
"0d398608930d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
8910
fbevents.js
connect.facebook.net/en_US/ Frame BDC5
92 KB
24 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23959
x-fb-rlafr
0
pragma
public
x-fb-debug
rKlSwu6y+HE9GJON0sFreZbxwZybouhs4IKYi+N5nZWPh4cChlJaiaW318F18xkPfY7tr4ywKQip1BasUlBhfw==
x-fb-trip-id
19638678
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 07 May 2021 17:28:06 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
5707359
bat.bing.com/p/action/ Frame BDC5
0
93 B
Script
General
Full URL
https://bat.bing.com/p/action/5707359
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Fri, 07 May 2021 17:28:05 GMT
cache-control
private,max-age=86400
x-msedge-ref
Ref A: 238DD0A88C684FDC84E31BDA91FBFA5C Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
x-powered-by
ARR/3.0
980746741982743
connect.facebook.net/signals/config/ Frame BDC5
40 KB
11 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/980746741982743?v=2.9.39&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3bd7e2e819385244407aa5eddb862db6b42cac03a971dd313670df6b39fee349
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr
0
pragma
public
x-fb-debug
Zgsjs6kCud1RDGt4sL8LuNVNQi6tlGYjOKDSo+G3XoKClZit5+OMTnXGFp90ncVPk6CbRYCM7ffSzKv/LjZgVg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Fri, 07 May 2021 17:28:06 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071224235/ Frame BDC5
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071224235/?random=1620408486043&cv=9&fst=1620408486043&num=1&label=urIBCIWI8QcQq6vm_gM&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a576e072846cd9478abb333af2a9202360d9dc3bbe775d0386d9161de1fa639f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 07 May 2021 17:28:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1246
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ Frame BDC5
0
93 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5707359&Ver=2&mid=d9e584d0-ee16-439b-8afb-b3246b0b1453&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&p=https%3A%2F%2Fadservice.google.com%2F&r=&lt=167&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=611782
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Fri, 07 May 2021 17:28:05 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 04E68A448D214723B7FC79B069B9DB88 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:06Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/1071224235/ Frame BDC5
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/1071224235/?random=1620408486043&cv=9&fst=1620406800000&num=1&label=urIBCIWI8QcQq6vm_gM&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=1725249624&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 07 May 2021 17:28:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1071224235/ Frame BDC5
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1071224235/?random=1620408486043&cv=9&fst=1620406800000&num=1&label=urIBCIWI8QcQq6vm_gM&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=1725249624&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 07 May 2021 17:28:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ Frame BDC5
44 B
410 B
Image
General
Full URL
https://www.facebook.com/tr/?id=980746741982743&ev=PageView&dl=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&rl=https%3A%2F%2Fadservice.google.com%2F&if=true&ts=1620408486123&sw=1600&sh=1200&v=2.9.39&r=stable&ec=0&o=28&it=1620408486037&coo=false&exp=l1&rqm=GET
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:06 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Fri, 07 May 2021 17:28:06 GMT
/
www.facebook.com/tr/ Frame BDC5
44 B
214 B
Image
General
Full URL
https://www.facebook.com/tr/?id=980746741982743&ev=ViewContent&dl=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&rl=https%3A%2F%2Fadservice.google.com%2F&if=true&ts=1620408486128&cd[type]=HomepageDefault&sw=1600&sh=1200&v=2.9.39&r=stable&ec=1&o=28&it=1620408486037&coo=false&exp=l1&rqm=GET
Requested by
Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://2992003.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:06 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Fri, 07 May 2021 17:28:06 GMT
OrchestratorMain.js
switchlower.me/public/design-kit/4.0/qualtrics/
79 KB
19 KB
Script
General
Full URL
https://switchlower.me/public/design-kit/4.0/qualtrics/OrchestratorMain.js
Requested by
Host: switchlower.me
URL: https://switchlower.me/
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd093e9b0608d6c7f56f32ead8e0fafe244622696db732e8b821e43336fc1ff6
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

:path
/public/design-kit/4.0/qualtrics/OrchestratorMain.js
pragma
no-cache
cookie
__cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; at_check=true; RT="z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"; AMCVS_71FF20B3534568190A490D45%40AdobeOrg=1; _ga=GA1.2.596866999.1620408486; _gid=GA1.2.465509405.1620408486; _gat_gtag_UA_34118221_1=1; _gcl_au=1.1.1630048557.1620408486; _uetsid=954d3c30af5911eb8ece03e36c264b59; _uetvid=954d5eb0af5911eba01669dc7f83441f; AMCV_71FF20B3534568190A490D45%40AdobeOrg=-1124106680%7CMCIDTS%7C18755%7CMCMID%7C80541991993212901553681286375836860207%7CMCAAMLH-1621013285%7C6%7CMCAAMB-1621013285%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1620415685s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18762%7CvVersion%7C5.2.0; mbox=session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346|PC#cae3fc0fd95b4e7cb9a840050ace94f5.37_0#1683653286; utm_gpv_pageName=Static%3AHomePage%3ADefault; s_cc=true
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
switchlower.me
referer
https://switchlower.me/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:06 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"report_to":"cf-nel","max_age":604800}
x-cdn
Imperva
x-iinfo
10-13673756-13673757 SNNN RT(1620384797064 14302) q(0 0 0 0) r(1 1) U5
server-timing
cdn-cache; desc=HIT edge; dur=1
vary
Accept-Encoding
cf-request-id
09e978617900003237ac2e1000000001
last-modified
Fri, 07 May 2021 10:54:31 GMT
server
cloudflare
x-frame-options
sameorigin
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZL8tS71ORKI3cmQsaHpPoUE1vWTD18nxkWRmhK8swx8UsGdqyA%2FUpiPcG55QBB9NovaOrF%2FdxrZTEGbhhZHdU5zp%2FE6cHL2asB2oXrmIBuKSeX2NtPl7M%2BOviQ%3D%3D"}]}
content-type
application/javascript
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
cache-control
max-age=14400
content-security-policy
frame-ancestors 'self'
cf-ray
64bc29af2c873237-FRA
status.js
geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/
173 B
1 KB
Script
General
Full URL
https://geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/status.js
Requested by
Host: geico.chat.digital.ringcentral.com
URL: https://geico.chat.digital.ringcentral.com/assets/messaging-60e0faac6e7fc4e05ea22dc54f59253efa19d77cd18348db4a13ddfb05cfc701.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.219.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
aa36da1a4932b324f.awsglobalaccelerator.com
Software
/
Resource Hash
2cdc61f9c76d8c6956f07c4a218b06b84ff7dcc3649619083dc752d78f90607b
Security Headers
Name Value
Strict-Transport-Security max-age=31556952; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
access-control-max-age
1728000
strict-transport-security
max-age=31556952; includeSubDomains
x-xss-protection
1; mode=block
x-request-id
8d17300e0c32bfcff860292e9b36de40
x-runtime
0.018029
x-rp-cache
HIT
referrer-policy
strict-origin-when-cross-origin
x-frame-options
SAMEORIGIN
etag
W/"2cdc61f9c76d8c6956f07c4a218b06b8"
x-download-options
noopen
vary
Accept-Encoding
access-control-allow-methods
POST, GET, PUT, DELETE, OPTIONS
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=10, public
permissions-policy
camera=(), geolocation=(), microphone=()
access-control-allow-headers
Accept, Accept-Encoding, Content-Description, Content-Disposition, Content-Range, Content-Type, Origin, X-Requested-With
expires
Fri, 07 May 2021 17:28:12 GMT
RCb51b55667ea04601bac1abe9ae1cd083-source.min.js
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/
372 B
508 B
Script
General
Full URL
https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RCb51b55667ea04601bac1abe9ae1cd083-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
5fb1c99cc27994d004f3ab66ac87a22f5ed74c56f006e0d19cf4304a4a066668

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:06 GMT
content-encoding
gzip
last-modified
Fri, 07 May 2021 16:00:54 GMT
server
AkamaiNetStorage
etag
"8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://switchlower.me
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
243
expires
Fri, 07 May 2021 18:28:06 GMT
s74330515715558
sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/
43 B
211 B
Image
General
Full URL
https://sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/s74330515715558?AQB=1&ndh=1&pf=1&t=7%2F4%2F2021%2019%3A28%3A6%205%20-120&mid=80541991993212901553681286375836860207&aamlh=6&ce=UTF-8&ns=geico&pageName=Static%3AHomePage%3ADefault&g=https%3A%2F%2Fswitchlower.me%2F&cc=USD&c2=https%3A%2F%2Fswitchlower.me%2F&c5=2.22.0&c14=Non-Mobile%20App%20Experience&c15=v&v15=v&v18=Static%3AHomePage%3ADefault&v21=Non-Mobile%20App%20Experience&c28=8.007.1_P&c48=updatedatanopageturn&c50=English&c53=596866999.1620408486&v55=https%3A%2F%2Fswitchlower.me%2F&v65=Static%3AAgentChat%3ANoAgentsAvailable&v74=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F89.0.4389.72%20Safari%2F537.36&pe=lnk_o&pev2=updatedatanopageturn&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=71FF20B3534568190A490D45%40AdobeOrg&lrt=37&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-76-117.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://switchlower.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 07 May 2021 17:28:06 GMT
x-content-type-options
nosniff
x-c
main-1461.Id0ac08.M0-490
p3p
CP="This is not a P3P policy"
vary
*
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 08 May 2021 17:28:06 GMT
server
jag
xserver
anedge-76898875b9-wjvrh
etag
3479800728547459072-4621921973716726464
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Thu, 06 May 2021 17:28:06 GMT

Verdicts & Comments Add Verdict or Comment

170 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| QSI object| geicoDtm object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| BOOMR_lstart object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| QuantumMetricOnload object| _dataManager object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq object| s string| language function| initialize_modals function| bind_modal_triggers function| pad_anchor_content function| sticky_banner_scroll function| setDTM function| updateDTM function| $ function| jQuery object| Modernizr object| GdkNPM function| FormValidator object| GDK function| nav_login_express function| ins_partners function| init_geo_zip function| geo_zip_success function| set_geo_cookie function| display function| get_cookie_domain function| checkZip function| spanishInternalModal function| submitZipInternal function| submitZip function| submitZipExternal function| format_quote_form function| format_hp_actions function| format_disclaimer function| update_quote_button_text function| recallWindow function| keypressZip function| IsNumeric function| remember_me function| close_location_menu boolean| has_submitted function| geo_lookup_error number| current_page function| scroll_products number| visible_product_count function| select_product function| recallStartNew function| animateBanner function| setDayGreeting function| set_zip_required_msg function| set_product_tabindex undefined| products undefined| productModal object| showZIP object| hideCheckBox undefined| modalMore undefined| productIcon undefined| product_inputs string| boatInput string| petInput undefined| lifeInput string| jewelryInput function| selectProduct function| removeSubmit function| addBundling function| removeBundling undefined| zipValue object| catxModal undefined| checkVal function| validation function| spanishModalButton function| spanishDTM function| openModalCATX number| seconds undefined| timer function| secondsTimer function| countdownClear function| consoleLog object| get function| _get_set string| _SearchIn object| _Variables object| dataLayer function| gtag string| param_str object| param_list object| param_array undefined| isMobile object| nav_config object| external_disclaimer_manage_modal object| product-modal object| recall_modal object| catx_disclaimer_modal object| external_disclaimer_quote_modal object| property_jewelry_modal object| external_disclaimer_recall_modal string| key string| type string| geoMobileHTML object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| florida_zipcodes function| _isContains object| uetq string| florida_dynamicModal object| florida_filter_modal object| gaplugins object| gaGlobal object| gaData number| timeout_time string| geo_type function| get_geo_data function| coords_to_data function| get_distance function| UET object| ttMETA object| s_i_geico-prod object| _internal_chatq object| DimeloAsyncLoader object| Dimelo undefined| define undefined| exports undefined| _ undefined| CrossStorageClient undefined| Base64 undefined| Faye undefined| Handlebars undefined| emojione object| _chatq number| BOOMR_onload undefined| client object| lediv function| Axel_myFunction object| el function| updateStartChatDTM function| updateLinkDTM

16 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUnrqHLLpthz-9eDpoLJEOif3NClvnLGEX2dcAAd5aKx8_5LqJ94mae2rtulxT4
.switchlower.me/ Name: s_cc
Value: true
.switchlower.me/ Name: mbox
Value: session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346|PC#cae3fc0fd95b4e7cb9a840050ace94f5.37_0#1683653286
.demdex.net/ Name: demdex
Value: 80437627143179642533706993118307813721
.switchlower.me/ Name: AMCV_71FF20B3534568190A490D45%40AdobeOrg
Value: -1124106680%7CMCIDTS%7C18755%7CMCMID%7C80541991993212901553681286375836860207%7CMCAAMLH-1621013285%7C6%7CMCAAMB-1621013285%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1620415685s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18762%7CvVersion%7C5.2.0
.switchlower.me/ Name: _gcl_au
Value: 1.1.1630048557.1620408486
.switchlower.me/ Name: _gat_gtag_UA_34118221_1
Value: 1
.switchlower.me/ Name: _gid
Value: GA1.2.465509405.1620408486
.switchlower.me/ Name: _ga
Value: GA1.2.596866999.1620408486
.switchlower.me/ Name: utm_gpv_pageName
Value: Static%3AHomePage%3ADefault
.switchlower.me/ Name: AMCVS_71FF20B3534568190A490D45%40AdobeOrg
Value: 1
.switchlower.me/ Name: _uetsid
Value: 954d3c30af5911eb8ece03e36c264b59
.switchlower.me/ Name: RT
Value: "z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"
.switchlower.me/ Name: at_check
Value: true
.switchlower.me/ Name: _uetvid
Value: 954d5eb0af5911eba01669dc7f83441f
.switchlower.me/ Name: __cfduid
Value: db4d345d4056d217ef278a035fadfaefe1620408484

1 Console Messages

Source Level URL
Text
console-api log (Line 2)
Message:
bing pixel reached

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2992003.fls.doubleclick.net
adservice.google.com
adservice.google.de
assets.adobedtm.com
bat.bing.com
c.go-mpulse.net
cm.everesttech.net
connect.facebook.net
dpm.demdex.net
geico.chat.digital.ringcentral.com
geico.demdex.net
geico.tt.omtrdc.net
googleads.g.doubleclick.net
s.go-mpulse.net
sadobeanalytics.geico.com
stats.g.doubleclick.net
switchlower.me
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
13.248.219.41
15.237.76.117
172.217.16.134
172.217.23.98
2606:4700:3036::6815:313b
2620:1ec:c11::200
2a00:1450:4001:803::2003
2a00:1450:4001:808::2004
2a00:1450:4001:80e::2004
2a00:1450:4001:811::2008
2a00:1450:4001:813::2002
2a00:1450:4001:829::200e
2a00:1450:400c:c04::9a
2a02:26f0:6c00:19a::11a6
2a02:26f0:6c00:287::11a6
2a02:26f0:6c00:28a::1e80
2a03:2880:f008:8:face:b00c:0:1
2a03:2880:f108:83:face:b00c:0:25de
34.250.160.147
34.251.77.56
34.255.166.243
52.30.135.179
02515ee3f986616cc4c0002e575e48e18590e77869a3a3d2d60136bb45a49c6b
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2a04c92b65295ae102f2bcedbd8de8ee7c506a962a691de8f4afa0aa6ac21699
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2cdc61f9c76d8c6956f07c4a218b06b84ff7dcc3649619083dc752d78f90607b
2eff1ef7b6768e5f7b659875e3b8d8c426e2446005fb79e10446412403ad45a5
3183481f09352eade87e53d32ac3c1f6ab5b853e2b5bde4035834680b53d9299
3217a6955b600825965f424d1cf73bc156ade880bcb4e16760cfe1771e2da89e
3394c09a692efd1a3d777125b9802b11582b53ff86390951b47f526a0c9baa04
35356a15f7cd1664f1da8ae6e5d0cd6e573a25b40c5e7c9ea31aa69e93a8b1e3
395f845728799f09f018fed5c842d831286a819584253df9e588d8ad733a32b0
3bd7e2e819385244407aa5eddb862db6b42cac03a971dd313670df6b39fee349
3bf5254dbd435444aae1d45cdcdbf10cec495b78b8d752a1acc5c1b566d97632
47a3e3b64cffe3ff820ebe554ac4df940da5ed469eaddbbc13bdd3b0b1eb4479
4942742285c81ae389c8e777cf0863a46ad8d2e3c64d97ee500a4529290e4927
4f6a9c99d36c51fabdd3e290c6a7fafb8252e6f34627d37d133ee9381a7880e5
50e2012d10fecd1d38c717dc5d3d4f6023dbc57808e366073a2b200186c170d0
5fb1c99cc27994d004f3ab66ac87a22f5ed74c56f006e0d19cf4304a4a066668
63413259cbaefb160e5ade88d65669a85beb447007edb1eb6f58daeba865822e
693c0b99b3d10d845d4e23e4f49385f3ca54445d6d4ebb03f45d6c45fd0477a7
7812342c0b0cbd5d699200f898538345f1ff23516280121e9916e1fc915b0770
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7d0b5bd193c90a7a7137fa4b7243191e88ab993ec428fd7112bc4bad5da49267
83d8ecff1ddd5c63be5338ca0a1130a3009f4a581217407c7eb5960b591420de
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8795f3f4ee117ffdd061a733d2c514ec91df4fc24fa01d7304401da603a23b92
8d58ae704ad171d099f8bfbf270baa32161974f8a598238f15301db25ec83f4a
926c2f23ee30acb05d85b0f176a502e86d4d767ed750ed35efe2787fb5e52847
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
98cf2519495224f38de05c45472bed5960643518e8dfd8aceee77bd3701f872c
9d7f13a127f5e543f983ffa8c106b7e708c20a6ddfbf205d2cd0178e8572a3cb
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05
a576e072846cd9478abb333af2a9202360d9dc3bbe775d0386d9161de1fa639f
a6135d6c9e52110c5bebdc942bc27c30004ef47f5bc05f390212a35da68c3ad5
b2d645f512e2d3f262fe912bb745d171f1ffd5bc940064b6ac0a8f7f8a9e018a
b42d9140930e69978c71b2f4637a72c3c715584552be9ad78f3b8328273dca1d
b6b19992ce19edffbf47e2e0e2700e15779ab8c0961b4375b3473a6d97267bb1
bcd6d6544b04396263538bcbdc14c305491cf039b8f0a1e826601964597c26d4
c16083359eec24e8fecdd8bfed214525be923db82ef853b5cd5d9105f5361254
c61fd39ef07aabeb2f53fff7048f24fb331da3220ca05b48f5986e7621b37667
d3f2c447994284b8fceb218aea1be93ed8640335ce15eb100188a5cb52179970
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d79217c6457a51cac79e8b968475030bd8b7e8de9d86b00f061233ff37871177
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e02c6c70d246d353fc47a1ed35d6dd3214bcc536e8b695f86c386d9d52423de5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb304a59575d781637c1129287d5b5ad03937c584953e24167266370f015387
f2bc2b36ee0cdf606f492175e7694d827aff1c6fa5dcfcc2f6ca0eb9f031071f
fac4c46db204bd889e464a6f0eafb1dc763961700bbd4441578acea61d1c46aa
fd093e9b0608d6c7f56f32ead8e0fafe244622696db732e8b821e43336fc1ff6