switchlower.me Open in urlscan Pro
2606:4700:3036::6815:313b Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://switchlower.me/
Effective URL:
https://switchlower.me/
Submission: On May 07 via manual (May 7th 2021, 5:28:22 pm UTC) from US

Summary HTTP 64 Redirects Links 36 Behaviour Indicators

Summary

This website contacted 22 IPs in 6 countries across 17 domains to perform 64 HTTP transactions. The main IP is 2606:4700:3036::6815:313b, located in United States and belongs to CLOUDFLARENET, US. The main domain is switchlower.me.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 22nd 2020. Valid for: a year.

This is the only time switchlower.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 22	2606:4700:303... 2606:4700:3036::6815:313b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a02:26f0:6c0... 2a02:26f0:6c00:28a::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:6c0... 2a02:26f0:6c00:287::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 3	52.30.135.179 52.30.135.179	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
3	13.248.219.41 13.248.219.41	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
7	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:6c0... 2a02:26f0:6c00:19a::11a6	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	34.250.160.147 34.250.160.147	16509 (AMAZON-02) (AMAZON-02)
3	15.237.76.117 15.237.76.117	16509 (AMAZON-02) (AMAZON-02)
1 1	34.255.166.243 34.255.166.243	16509 (AMAZON-02) (AMAZON-02)
1	34.251.77.56 34.251.77.56	16509 (AMAZON-02) (AMAZON-02)
1 3	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f00... 2a03:2880:f008:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f10... 2a03:2880:f108:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
64	22

22 2606:4700:3036::6815:313b (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

switchlower.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:6c00:28a::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:287::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

s.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.30.135.179 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-135-179.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.248.219.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: aa36da1a4932b324f.awsglobalaccelerator.com

geico.chat.digital.ringcentral.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:19a::11a6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

c.go-mpulse.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.250.160.147 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-160-147.eu-west-1.compute.amazonaws.com

geico.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.237.76.117 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-237-76-117.eu-west-3.compute.amazonaws.com

sadobeanalytics.geico.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.255.166.243 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-166-243.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.251.77.56 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-77-56.eu-west-1.compute.amazonaws.com

geico.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f6.1e100.net

2992003.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f008:8:face:b00c:0:1 (Milan, Italy)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f108:83:face:b00c:0:25de (Milan, Italy)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	switchlower.me 1 redirects switchlower.me	358 KB
7	bing.com bat.bing.com	18 KB
6	adobedtm.com assets.adobedtm.com	112 KB
5	doubleclick.net 1 redirects 2992003.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	4 KB
4	demdex.net 1 redirects dpm.demdex.net geico.demdex.net	6 KB
3	google.de 1 redirects www.google.de adservice.google.de	438 B
3	google.com www.google.com adservice.google.com	674 B
3	geico.com sadobeanalytics.geico.com	940 B
3	ringcentral.com geico.chat.digital.ringcentral.com	211 KB
2	facebook.com www.facebook.com	624 B
2	facebook.net connect.facebook.net	35 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	googletagmanager.com www.googletagmanager.com	68 KB
2	go-mpulse.net s.go-mpulse.net c.go-mpulse.net	51 KB
1	googleadservices.com www.googleadservices.com	17 KB
1	omtrdc.net geico.tt.omtrdc.net	505 B
1	everesttech.net 1 redirects cm.everesttech.net	517 B
64	17

	Domain	Requested by
22	switchlower.me	1 redirects switchlower.me
7	bat.bing.com	switchlower.me bat.bing.com 2992003.fls.doubleclick.net
6	assets.adobedtm.com	assets.adobedtm.com
3	2992003.fls.doubleclick.net	1 redirects www.googletagmanager.com adservice.google.com
3	sadobeanalytics.geico.com	assets.adobedtm.com switchlower.me
3	geico.chat.digital.ringcentral.com	switchlower.me geico.chat.digital.ringcentral.com
3	dpm.demdex.net	1 redirects switchlower.me
2	www.facebook.com	2992003.fls.doubleclick.net
2	connect.facebook.net	2992003.fls.doubleclick.net connect.facebook.net
2	www.google.de	switchlower.me 2992003.fls.doubleclick.net
2	www.google.com	switchlower.me 2992003.fls.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	2992003.fls.doubleclick.net
1	adservice.google.de	1 redirects
1	adservice.google.com	2992003.fls.doubleclick.net
1	stats.g.doubleclick.net	www.google-analytics.com
1	geico.tt.omtrdc.net	assets.adobedtm.com
1	cm.everesttech.net	1 redirects
1	geico.demdex.net	assets.adobedtm.com
1	c.go-mpulse.net	s.go-mpulse.net
1	s.go-mpulse.net	switchlower.me
64	23

This site contains links to these domains. Also see Links.

Domain
media.geico.com
ecams.geico.com
geico.app.link
careers.geico.com
commercial.geico.com
www.jdpower.com
itunes.apple.com
play.google.com
www.facebook.com
twitter.com
www.instagram.com
www.tiktok.com
www.linkedin.com
www.youtube.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-06-22` - `2021-06-22`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-08` - `2021-09-30`	9 months	crt.sh
akstat.io DigiCert Secure Site ECC CA-1	`2020-05-06` - `2021-08-05`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
digital.ringcentral.com Amazon	`2020-09-16` - `2021-10-18`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-04-12` - `2021-10-12`	6 months	crt.sh
sadobeanalytics.geico.com DigiCert SHA2 High Assurance Server CA	`2020-04-13` - `2021-07-16`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 Secure Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
*.google.com GTS CA 1O1	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-04-06` - `2021-07-03`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://switchlower.me/
Frame ID: 1599D41FFC46810F971455622E07BA20
Requests: 48 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/LBAJ4-7RCLK-J6VHB-MN55E-J4AYH
Frame ID: CD2CFF1F6713DA29CD24C7488C4D63B5
Requests: 2 HTTP requests in this frame

Frame: https://geico.demdex.net/dest5.html?d_nsid=0
Frame ID: 7ECA0287CEEAA4898E6EC703A955D976
Requests: 1 HTTP requests in this frame

Frame: https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Frame ID: B8E53DEACB13F72136392541A08A3433
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Frame ID: 482E9BDABD194C04CFABFE908A522546
Requests: 1 HTTP requests in this frame

Frame: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Frame ID: BDC58DA9B5B308A772E3C57C726DCA32
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://switchlower.me/ HTTP 301
https://switchlower.me/ Page URL

Detected technologies

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

64
Requests

100 %
HTTPS

64 %
IPv6

17
Domains

23
Subdomains

22
IPs

6
Countries

900 kB
Transfer

3219 kB
Size

16
Cookies

36 Outgoing links

These are links going to different origins than the main page.

URL: https://media.geico.com/legal/cookie_policy.html
Title: cookie policy

Search URL Search Domain Scan URL

URL: https://media.geico.com/legal/privacy_policy.htm
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://ecams.geico.com/express?action=ID_CARD&traceback=static_exp_id
Title: Get ID Cards

Search URL Search Domain Scan URL

URL: https://ecams.geico.com/express?action=VEHICLE&traceback=static_exp_veh
Title: Add A Vehicle

Search URL Search Domain Scan URL

URL: https://ecams.geico.com/express?action=PAPERLESS&traceback=static_exp_paperless
Title: Go Paperless

Search URL Search Domain Scan URL

URL: https://ecams.geico.com/activation?traceback=static
Title: Create Online Account

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticInformationPanelReportaClaim
Title: Report a Claim

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticInformationPanelViewClaim
Title: View a Claim

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticInformationClaimsGetERS
Title: Get Roadside Help

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticInfoPanelReportGlassDamage
Title: Report Glass Damage

Search URL Search Domain Scan URL

URL: https://careers.geico.com/us/en/
Title: Careers

Search URL Search Domain Scan URL

URL: https://geico.app.link/static/GEICOApp?~campaign=Campaign:Static:HomePage:Default
Title: GEICO Mobile App

Search URL Search Domain Scan URL

URL: https://ecams.geico.com/express?action=PAY_AND_ENROLL&traceback=static_exp_pay
Title: Make a payment

Search URL Search Domain Scan URL

URL: https://ecams.geico.com/ecams/login
Title: login

Search URL Search Domain Scan URL

URL: https://commercial.geico.com/Service/ForgotUserId.aspx
Title: User ID

Search URL Search Domain Scan URL

URL: https://commercial.geico.com/Service/ForgotPassword.aspx
Title: password

Search URL Search Domain Scan URL

URL: https://commercial.geico.com/Service/Register.aspx
Title: Sign up for online access

Search URL Search Domain Scan URL

URL: https://geico.app.link/StaticLogInPanelReportIncident
Title: Report an incident

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticLogInPanelTrackClaim
Title: Track a claim

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticLogInReportGlass
Title: Report glass-only damage

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticHomeRequestERS
Title: Request roadside assistance

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticHomeReportAnIncident
Title: Report an Incident

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticHomeTrackClaim
Title: Track a claim

Search URL Search Domain Scan URL

URL: https://geico.app.link/staticHomeReportGlassDamage
Title: Report glass-only damage

Search URL Search Domain Scan URL

URL: https://www.jdpower.com/business/press-releases/2020-us-auto-insurance-study
Title: J.D. Power

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/app/id331763096
Title:

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.geico.mobile
Title:

Search URL Search Domain Scan URL

URL: https://www.facebook.com/geico

Search URL Search Domain Scan URL

URL: https://twitter.com/geico

Search URL Search Domain Scan URL

URL: https://www.instagram.com/geico/

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/@geico?lang=en

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/geico/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/GEICO

Search URL Search Domain Scan URL

URL: https://ecams.geico.com/login
Title: Login to Your Policy

Search URL Search Domain Scan URL

URL: https://geico.app.link/static/claims?~campaign=Campaign:Static:Claims:Main
Title: Report an Incident

Search URL Search Domain Scan URL

URL: https://geico.app.link/static/claims/dashboard?~campaign=Campaign:Static:Claims:Main
Title: Track a Claim

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://switchlower.me/ HTTP 301
https://switchlower.me/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347

Request Chain 35

https://cm.everesttech.net/cm/dd?d_uuid=80437627143179642533706993118307813721 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u

Request Chain 38

https://2992003.fls.doubleclick.net/activityi;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F HTTP 302
https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F

Request Chain 46

https://adservice.google.de/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F HTTP 302
https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F

64 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
switchlower.me/
Redirect Chain

http://switchlower.me/
https://switchlower.me/

97 KB
17 KB

245ms
222ms

Document
text/html

2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c16083359eec24e8fecdd8bfed214525be923db82ef853b5cd5d9105f5361254

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: switchlower.me
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:04 GMT
content-type: text/html; charset=UTF-8
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-frame-options: sameorigin
content-security-policy: frame-ancestors 'self'
link: <https://assets.adobedtm.com>; rel=preconnect <https://www.googletagmanager.com>; rel=preconnect <https://dpm.demdex.net>; rel=preconnect <https://vt.myvisualiq.net>; rel=preconnect <https://t.myvisualiq.net>; rel=preconnect <https://p.tvpixel.com>; rel=preconnect <https://d.turn.com>; rel=preconnect <https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js>; rel=preload; as=script
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-cdn: Imperva
x-iinfo: 5-27347399-27356022 SNNN RT(1620408343996 140137) q(0 0 0 -1) r(1 1) U5
x-akamai-transformed: 9 17568 0 pmb=mRUM,2
expires: Fri, 07 May 2021 17:28:04 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
set-cookie: visid_incap_1684653=k8Ka49AeQZyIFqFW/xycXqR4lWAAAAAAQUIPAAAAAAAdzxewh2ZXfj9yPUojuPJJ; expires=Sat, 07 May 2022 09:32:47 GMT; HttpOnly; path=/; Domain=.geico.com; Secure; SameSite=None incap_ses_875_1684653=prt5av7cFnJf7+bO/Z8kDKR4lWAAAAAA7FIqFnWtEyVQUfREWwN/3w==; path=/; Domain=.geico.com; Secure; SameSite=None
server-timing: edge; dur=4 origin; dur=148 cdn-cache; desc=MISS
cf-cache-status: DYNAMIC
cf-request-id: 09e9785aef000006319b124000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=feB%2BTfn%2FXV4HdnCqByfNIexi7jUQd36o9SFO9nJzw0GY62cjl56jvSroX09Q2JYBe6VlHHVYxPTM7uUoOeUxN0Zi5Gtlc0BvJtvfJ63mztvx54OWdZQiRR%2F1PA%3D%3D"}],"group":"cf-nel"}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 64bc29a4be1b0631-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Date: Fri, 07 May 2021 17:28:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; expires=Sun, 06-Jun-21 17:28:04 GMT; path=/; domain=.switchlower.me; HttpOnly; SameSite=Lax
Location: https://switchlower.me/
CF-Cache-Status: DYNAMIC
cf-request-id: 09e9785a5f00004edf1b1f3000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3o0B7Ve25tp7l3aVVb9sBVwfXbnrqg0JyMTlTmtaQtGDDJ9COutQ7j4yTf9eC6iP50VjgSpbkDoWmDfukSfo2rtzY8Uf%2BHFlFwwznAqrp%2FQISWvBk3AojD5snw%3D%3D"}],"max_age":604800,"group":"cf-nel"}
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
CF-RAY: 64bc29a3cf9b4edf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js Show response
assets.adobedtm.com/ 355 KB
96 KB 32ms
17ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7812342c0b0cbd5d699200f898538345f1ff23516280121e9916e1fc915b0770

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:04 GMT
content-encoding: gzip
last-modified: Fri, 07 May 2021 16:00:53 GMT
server: AkamaiNetStorage
etag: "17bc2f81777082a70ca78c561e1d3829:1620403253.91403"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://switchlower.me
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 May 2021 18:28:04 GMT

GET
H3-29 200 cache-base-css.php
switchlower.me/public/css/design6/ 263 KB
33 KB 89ms
74ms Stylesheet
text/css 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/css/design6/cache-base-css.php

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6b19992ce19edffbf47e2e0e2700e15779ab8c0961b4375b3473a6d97267bb1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/css/design6/cache-base-css.php
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 2-8125975-8125976 NNNN CT(89 91 0) RT(1620384759346 1) q(0 0 2 0) r(3 3) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 09e9785be600003237a1335000000001
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6WgTFjocBJCKeNL0T3jx1CQQlCeRyhljurgpK4DfOXpF4ycKSwBuyURjNE%2B7Ehmxf3ahbYXLVRSh637b5S5qEebl3laa%2FLvLwmqjTP20CYBO5hlnXEwBa0O8XQ%3D%3D"}]}
content-type: text/css;charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: max-age=3600
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a6396b3237-FRA

GET
H3-29 200 geico.com.css
switchlower.me/public/css/design6/ 29 KB
6 KB 97ms
81ms Stylesheet
text/css 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/css/design6/geico.com.css

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3394c09a692efd1a3d777125b9802b11582b53ff86390951b47f526a0c9baa04

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/css/design6/geico.com.css
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 12-118103248-118103256 SNNN RT(1620384757095 9971) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
cf-request-id: 09e9785be7000032377f87c000000001
last-modified: Fri, 07 May 2021 10:55:43 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nDDcS3i8nTk93EatzHNpDMyK9BK%2BaW11dDIGxj%2FvOXnO1AoGGzyceJA22OneegxQv9uI3XYQL3r0mwsql8b%2ByRNxNoLziwz2iAYKXENxHbwqlelGD0QWohp4Cw%3D%3D"}]}
content-type: text/css
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a639753237-FRA

GET
H3-29 200 main.css
switchlower.me/public/css/homepage/design6/ 44 KB
8 KB 96ms
81ms Stylesheet
text/css 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/css/homepage/design6/main.css

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d0b5bd193c90a7a7137fa4b7243191e88ab993ec428fd7112bc4bad5da49267

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/css/homepage/design6/main.css
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 3-34323670-34323672 NNNN CT(30 33 0) RT(1620384758268 8) q(0 0 1 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
cf-request-id: 09e9785be700003237ee2a1000000001
last-modified: Fri, 07 May 2021 10:55:35 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9SlLL92veVGChmEb2PSS4pme1%2FkACnljUCwiKYq%2Fpe06q2DQ0fTql0i5mzRcXcEV5ipw%2BMK9S3MkOprQ06cyxk3bgJ8gQSrtX4QGqboLQ%2B5oX9ryaipPALE7Dg%3D%3D"}]}
content-type: text/css
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a639733237-FRA

GET
H3-29 200 gecko-side.jpg
switchlower.me/public/layout_images/homepage/design6/ 12 KB
12 KB 114ms
112ms Image
image/jpeg 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://switchlower.me/public/layout_images/homepage/design6/gecko-side.jpg

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efb304a59575d781637c1129287d5b5ad03937c584953e24167266370f015387

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/layout_images/homepage/design6/gecko-side.jpg
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 14-36138804-36138805 PNNN RT(1620384750561 9400) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
content-length: 11797
cf-request-id: 09e9785ca9000032377f88f000000001
last-modified: Thu, 06 May 2021 14:01:29 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PkhuLbdusLQ20twYkHlImqfrshsi5CeEFdFAoY0xxYxKROlnIRXcYJhOGNKVT2lalAOnT362ZNxjRlIAmeSqhx2xzJSjgHwMPNK9NiUA7cIqeChaOE8ndVtP4Q%3D%3D"}]}
content-type: image/jpeg
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
accept-ranges: bytes
cf-ray: 64bc29a76c1c3237-FRA

GET
H3-29 200 ranked-1.png
switchlower.me/public/layout_images/homepage/design6/jdpower/ 2 KB
3 KB 129ms
127ms Image
image/png 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://switchlower.me/public/layout_images/homepage/design6/jdpower/ranked-1.png

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02515ee3f986616cc4c0002e575e48e18590e77869a3a3d2d60136bb45a49c6b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/layout_images/homepage/design6/jdpower/ranked-1.png
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 13-36486035-36561323 SNNN RT(1620384559511 275604) q(0 0 0 1) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
content-length: 2538
cf-request-id: 09e9785ca600003237c6a94000000001
last-modified: Thu, 06 May 2021 14:01:29 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Czg3eG00NeLnCs92pGxXZTEuzlh7kvJfqOhh1qBqHVh3H%2F6dJcwbyCY%2BcfM6YTGptdPxL0JRSN9lzs3mAoUR%2FqZfPMo%2FGUU67RFyNF9cLmzMeDRSnwDmL%2FE1Iw%3D%3D"}]}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
accept-ranges: bytes
cf-ray: 64bc29a76c1e3237-FRA

GET
H3-29 200 jdpower.png
switchlower.me/public/layout_images/homepage/design6/jdpower/ 43 KB
43 KB 129ms
128ms Image
image/png 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://switchlower.me/public/layout_images/homepage/design6/jdpower/jdpower.png

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f2c447994284b8fceb218aea1be93ed8640335ce15eb100188a5cb52179970

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/layout_images/homepage/design6/jdpower/jdpower.png
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 9-39219011-39258232 SNNN RT(1620384592584 425493) q(0 0 0 -1) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
content-length: 43523
cf-request-id: 09e9785ca600003237cdac3000000001
last-modified: Thu, 06 May 2021 14:01:29 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lO7bYlUQSVd1%2BdqrM6p4Vmk4ykIzyoPLDpSVd6nVTyW13%2B9JXN6LLjEx05A7RALU7mmXxpeHeSpkMRvOeXWw7y1dPER3p%2FmVfSv7qx1go4OZ%2B%2B3OY%2BJACDlaLQ%3D%3D"}]}
content-type: image/png
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
accept-ranges: bytes
cf-ray: 64bc29a76c233237-FRA

GET
H3-29 200 geicoApp-AppStoreDL.jpg
switchlower.me/public/images/aboutgeico/mobile/ 3 KB
4 KB 131ms
130ms Image
image/jpeg 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://switchlower.me/public/images/aboutgeico/mobile/geicoApp-AppStoreDL.jpg

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

98cf2519495224f38de05c45472bed5960643518e8dfd8aceee77bd3701f872c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/images/aboutgeico/mobile/geicoApp-AppStoreDL.jpg
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 4-38994025-38994026 SNNN RT(1620384703929 55449) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
content-length: 3100
cf-request-id: 09e9785ca700003237cd084000000001
last-modified: Fri, 07 May 2021 10:49:38 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UleAYl%2BOK3eJDk2FBaGa6WQo9fZkhMzACXy5rvZ8YsT7%2BMfViQa0%2F7XBkCNhH2gFYHR8VkQe3nTmuAEx0KcnVqeaDkN3uWh1hqJ0gULWWvZ8gN7fEmUW6xDNkA%3D%3D"}]}
content-type: image/jpeg
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
accept-ranges: bytes
cf-ray: 64bc29a76c263237-FRA

GET
H3-29 200 geicoApp-GooglePlayDL.jpg
switchlower.me/public/images/aboutgeico/mobile/ 3 KB
4 KB 133ms
132ms Image
image/jpeg 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://switchlower.me/public/images/aboutgeico/mobile/geicoApp-GooglePlayDL.jpg

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d79217c6457a51cac79e8b968475030bd8b7e8de9d86b00f061233ff37871177

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/images/aboutgeico/mobile/geicoApp-GooglePlayDL.jpg
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 10-45587347-45606676 SNNN RT(1620384599954 159429) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
content-length: 2878
cf-request-id: 09e9785ca700003237e93c5000000001
last-modified: Fri, 07 May 2021 10:49:38 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mJ1fxXI6peWMBJUC6gGldduV7HiaOhqeJtE2v2fdPhKdidqOo3GJY%2FmOf8LIqykRs6MgcKr07cf5ZkWcEJm2ILcKIhwzOHxvFx2WCUoZBCY6aV6v7o7gQnd2LQ%3D%3D"}]}
content-type: image/jpeg
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
accept-ranges: bytes
cf-ray: 64bc29a76c283237-FRA

GET
H3-29 200 email-decode.min.js Show response
switchlower.me/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 9ms
9ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
cf-request-id: 09e9785c3d00003237be019000000001
last-modified: Fri, 30 Apr 2021 09:06:15 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"608bc887-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gF0xKbaVXqUfW3xF5RlCEIHuR8GMXPiq03gCCR0YUpODO7WPgTG%2BoNNsWeBraSlvkG2MOjGuxiBwVe5CjTCOGwzggCz2WcGhX6v%2FiHOg%2FbN1JEV%2BHPDR7gdp6w%3D%3D"}]}
content-type: application/javascript
cache-control: max-age=172800 public
cf-ray: 64bc29a6ca953237-FRA
expires: Sun, 09 May 2021 17:28:04 GMT

GET
H3-29 200 cache-base-js.php Show response
switchlower.me/public/scripts/design6/ 450 KB
81 KB 113ms
113ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/scripts/design6/cache-base-js.php

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3bf5254dbd435444aae1d45cdcdbf10cec495b78b8d752a1acc5c1b566d97632

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/scripts/design6/cache-base-js.php
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 10-14316599-14358084 SNNN RT(1620384421417 337740) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 09e9785c8f00003237e93c3000000001
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MVN8FQBqCptmLxOK8aRsvqgCNbGeghO0TP4ggtbSZLUGZuWVkO4uepx%2B%2BoDk96xfoGzCkePspAAtqWyc7R9mr22BiPEKhIBgKXa5jYP9dB5VzoflsMJFVAPIFw%3D%3D"}]}
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: max-age=3600
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a74bbc3237-FRA

GET
H3-29 200 jquery.cookie.js Show response
switchlower.me/public/scripts/jquery/ 4 KB
2 KB 122ms
120ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/scripts/jquery/jquery.cookie.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f6a9c99d36c51fabdd3e290c6a7fafb8252e6f34627d37d133ee9381a7880e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/scripts/jquery/jquery.cookie.js
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 12-33908453-33908454 SNNN RT(1620384756492 2102) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
cf-request-id: 09e9785ca500003237f8b29000000001
last-modified: Fri, 07 May 2021 10:54:51 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=om71NFuBbCa6%2BBkOz4gJ6yr07FAgvdLYBMD3sfsVc7CxrzB0dH1wueH36ziUI%2Fix39HvoDp4mMf1NPSmtZV29kVBcw0R1daGciYIufY2sOOebIZK%2Fsmjc3P%2BGw%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a76c0d3237-FRA

GET
H3-29 200 global.js Show response
switchlower.me/public/scripts/design6/ 55 KB
11 KB 123ms
121ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/scripts/design6/global.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35356a15f7cd1664f1da8ae6e5d0cd6e573a25b40c5e7c9ea31aa69e93a8b1e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/scripts/design6/global.js
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 13-144161137-144161107 PNNN RT(1620384758725 60) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=2
vary: Accept-Encoding
cf-request-id: 09e9785ca40000323701a88000000001
last-modified: Fri, 07 May 2021 10:55:55 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=JPAhPv2nm1ZiSgelpRMwg18eULgIXx139Q4N7kA8NNzI0X0SMsaY6H466dhdUpbVKZqtfte%2B6UsPbWkYibgwuInLdehcZj4bjqDgCJCYVxFjjzKcdNc1bMdS8A%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a76c123237-FRA

GET
H3-29 200 homepage.js Show response
switchlower.me/public/scripts/design6/ 49 KB
8 KB 127ms
125ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/scripts/design6/homepage.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d7f13a127f5e543f983ffa8c106b7e708c20a6ddfbf205d2cd0178e8572a3cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/scripts/design6/homepage.js
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 10-2361346-2361347 SNNN RT(1620384757534 21951) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=3
vary: Accept-Encoding
cf-request-id: 09e9785ca500003237a7968000000001
last-modified: Fri, 07 May 2021 10:54:22 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xuFw8YejvTSNSTfgkrmS81ZPVzNXyhOSlhph32EELAjn1hqrOnj1%2FyHm%2FR8EX4eCHAV87NP1kiTKGseHXtWlewQpYBpXbEmigaMwJPMPwM0Adp9wzvM7ib5mhw%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a76c153237-FRA

GET
H3-29 200 getMethod.js Show response
switchlower.me/public/scripts/ 653 B
1 KB 127ms
125ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/scripts/getMethod.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e02c6c70d246d353fc47a1ed35d6dd3214bcc536e8b695f86c386d9d52423de5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/scripts/getMethod.js
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 12-130046669-130046676 NNNN CT(49 55 0) RT(1620384759049 44) q(0 0 2 2) r(2 2) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
cf-request-id: 09e9785ca800003237f8b2a000000001
last-modified: Fri, 07 May 2021 10:56:02 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4uq%2BqQuVCjFr8gyn4hfDrBKaYEPKfeQUVvZWHz1B3D8fE0oW8CUBMk87iuAle9hlyyvvQCNhzDWcCCckMh%2FSAnPZw14Bw58%2BYkCMah6I6UR2EbrE4zd8tIxSkQ%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a76c193237-FRA

GET
H2 200 LBAJ4-7RCLK-J6VHB-MN55E-J4AYH Show response
s.go-mpulse.net/boomerang/ Frame CD2C 202 KB
51 KB 302ms
7ms Script
application/javascript 2a02:26f0:6c00:287::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.go-mpulse.net/boomerang/LBAJ4-7RCLK-J6VHB-MN55E-J4AYH
Requested by: Host: switchlower.me
URL: https://switchlower.me/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:287::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
last-modified: Sat, 24 Apr 2021 13:32:13 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=604800
timing-allow-origin: *
content-length: 51580

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-29 200 lato-normal-400-latin.woff2
switchlower.me/public/design-kit/4.0/fonts/ 26 KB
26 KB 125ms
125ms Font
font/woff2 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/design-kit/4.0/fonts/lato-normal-400-latin.woff2

Requested by

Host: switchlower.me
URL: https://switchlower.me/public/css/design6/cache-base-css.php

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47a3e3b64cffe3ff820ebe554ac4df940da5ed469eaddbbc13bdd3b0b1eb4479

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

sec-fetch-mode: cors
origin: https://switchlower.me
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
:path: /public/design-kit/4.0/fonts/lato-normal-400-latin.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: switchlower.me
referer: https://switchlower.me/public/css/design6/cache-base-css.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://switchlower.me
Referer: https://switchlower.me/public/css/design6/cache-base-css.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 8-7512807-7523848 SNNN RT(1620384599330 182849) q(0 0 0 2) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=5
vary: Accept-Encoding
content-length: 26144
x-xss-protection: 1; mode=block
last-modified: Thu, 06 May 2021 14:01:29 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=S4cqnLqefPv5A1vDOct%2FY8pAgpKJLGZtKQUPbFMZ6RGan2udxTnJXi4%2F24J60JqCoSEBrX1e68g%2Fusd9lVJ%2F9I9AaPOAZmlQTh87LaMc5FdOihpb3XbtgLg41A%3D%3D"}]}
content-type: font/woff2
access-control-allow-origin: *
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-request-id: 09e9785cab00003237b11bf000000001
accept-ranges: bytes
cf-ray: 64bc29a77c313237-FRA

GET
H3-29 200 geico.ttf
switchlower.me/public/design-kit/4.0/fonts/ 82 KB
47 KB 119ms
118ms Font
font/ttf 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/design-kit/4.0/fonts/geico.ttf?r5709x

Requested by

Host: switchlower.me
URL: https://switchlower.me/public/css/design6/cache-base-css.php

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6135d6c9e52110c5bebdc942bc27c30004ef47f5bc05f390212a35da68c3ad5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

sec-fetch-mode: cors
origin: https://switchlower.me
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
:path: /public/design-kit/4.0/fonts/geico.ttf?r5709x
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: switchlower.me
referer: https://switchlower.me/public/css/design6/cache-base-css.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://switchlower.me
Referer: https://switchlower.me/public/css/design6/cache-base-css.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 9-17797948-17797949 SNNN RT(1620384787864 10226) q(0 0 0 0) r(2 2) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
cf-request-id: 09e9785cb200003237ef264000000001
last-modified: Thu, 06 May 2021 14:01:29 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=56kozXfy263UrsEVR%2F%2BcRe3RtJP3LHeDs1H%2FWnruHyS4gaagA8rvbths5jDgIU9mt80so6UqMfgOH%2FGyXNOcglCb3SoIo2GZ48psWp3sNUekqCex%2FS1%2Br01tNA%3D%3D"}]}
content-type: font/ttf
access-control-allow-origin: *
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29a78c4b3237-FRA

GET
H3-29 200 lato-normal-700-latin.woff2
switchlower.me/public/design-kit/4.0/fonts/ 25 KB
26 KB 124ms
123ms Font
font/woff2 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/design-kit/4.0/fonts/lato-normal-700-latin.woff2

Requested by

Host: switchlower.me
URL: https://switchlower.me/public/css/design6/cache-base-css.php

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63413259cbaefb160e5ade88d65669a85beb447007edb1eb6f58daeba865822e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

sec-fetch-mode: cors
origin: https://switchlower.me
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484
:path: /public/design-kit/4.0/fonts/lato-normal-700-latin.woff2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: switchlower.me
referer: https://switchlower.me/public/css/design6/cache-base-css.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://switchlower.me
Referer: https://switchlower.me/public/css/design6/cache-base-css.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 14-43714866-43714868 SNNN RT(1620384707041 82166) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
content-length: 25604
x-xss-protection: 1; mode=block
last-modified: Thu, 06 May 2021 14:01:29 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=euienv%2Bi2n%2BR5iAzdQ9aZLLtHuvIpV7u1uc94b1V2iFg0SN6baF5ytQrZsDhoRDYWjelsWBEBlC5Q68nw6WGwnZ5Fs1i6W5A0U%2BORibTCrpQIxTbKyOPOKvqzw%3D%3D"}]}
content-type: font/woff2
access-control-allow-origin: *
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-request-id: 09e9785cb300003237d4b24000000001
accept-ranges: bytes
cf-ray: 64bc29a78c4d3237-FRA

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347
https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347

364 B
1 KB

42ms
42ms

XHR
application/json

52.30.135.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.30.135.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-135-179.eu-west-1.compute.amazonaws.com

Software

Resource Hash

bcd6d6544b04396263538bcbdc14c305491cf039b8f0a1e826601964597c26d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v005-039530b64.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: zoOIf65MSDw=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://switchlower.me
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 308
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v005-02a349794.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://switchlower.me
X-TID: PSRg6qpNRy4=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.2.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=71FF20B3534568190A490D45%40AdobeOrg&d_nsid=0&ts=1620408485347
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://switchlower.me
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Fri, 07 May 2021 18:28:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-34118221-1&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

50e2012d10fecd1d38c717dc5d3d4f6023dbc57808e366073a2b200186c170d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35807
x-xss-protection: 0
last-modified: Fri, 07 May 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 May 2021 17:28:05 GMT

GET
H2 200 RCd3ddf95ceb1f42d89ad6930803f05061-source.min.js Show response
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/ 544 B
602 B 7ms
7ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RCd3ddf95ceb1f42d89ad6930803f05061-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 395f845728799f09f018fed5c842d831286a819584253df9e588d8ad733a32b0

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
last-modified: Fri, 07 May 2021 16:00:54 GMT
server: AkamaiNetStorage
etag: "8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://switchlower.me
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 337
expires: Fri, 07 May 2021 18:28:05 GMT

GET
H3-29 200 florida-zipcodes.js Show response
switchlower.me/public/scripts/ 26 KB
4 KB 73ms
73ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/scripts/florida-zipcodes.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/public/scripts/design6/global.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4942742285c81ae389c8e777cf0863a46ad8d2e3c64d97ee500a4529290e4927

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/scripts/florida-zipcodes.js
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; AMCV_71FF20B3534568190A490D45%40AdobeOrg=-1124106680%7CMCIDTS%7C18755%7CvVersion%7C5.2.0; mbox=session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346; at_check=true; RT="z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 8-30667403-30668094 NNNN CT(46 48 0) RT(1620384790630 69903) q(0 0 1 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=6
vary: Accept-Encoding
cf-request-id: 09e9785e7c00003237ef292000000001
last-modified: Fri, 07 May 2021 10:54:22 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tsFDsIwNOPiDQ7k5gvhVHvAYy1lx%2BdwTS5TXM9i3djgg9%2FSl%2FfdwTS2hkctgtzwhz5COn7PAxgA0yhBYHIEyoey23ZQtKVpnIedP%2BNAxsYNuurBhQjc%2FklLKIA%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29aa5a613237-FRA

GET
H3-29 200 geolocation.js Show response
switchlower.me/public/scripts/ 3 KB
2 KB 100ms
99ms XHR
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/scripts/geolocation.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/public/scripts/design6/cache-base-js.php

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

926c2f23ee30acb05d85b0f176a502e86d4d767ed750ed35efe2787fb5e52847

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

sec-fetch-mode: cors
accept-encoding: gzip, deflate, br
accept-language: en-US
x-requested-with: XMLHttpRequest
sec-fetch-dest: empty
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; AMCV_71FF20B3534568190A490D45%40AdobeOrg=-1124106680%7CMCIDTS%7C18755%7CvVersion%7C5.2.0; mbox=session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346; at_check=true; RT="z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"
:path: /public/scripts/geolocation.js
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept: */*
Referer: https://switchlower.me/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 14-86228770-87249984 NNNN CT(46 46 0) RT(1620378458723 6407135) q(0 0 1 0) r(2 2) U5
server-timing: cdn-cache; desc=HIT edge; dur=16
vary: Accept-Encoding
cf-request-id: 09e9785e8e0000323780253000000001
last-modified: Fri, 07 May 2021 10:54:27 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Tm19bCHwIaAQVVI3QTOrjpWVPvOv%2FGk6%2FljnfRr0LkTa4%2FbGARXEsvuT5Z5dtFgyzId%2BAFAIWTKD%2BxO38XLu2UpPIKLsdliOaoj6atUaSX3p8X%2BTD%2B5aNBD4vA%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29aa7aa23237-FRA

GET
H2 200 loader.js Show response
geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/ 36 KB
8 KB 308ms
103ms Script
text/javascript 13.248.219.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/loader.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.219.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

aa36da1a4932b324f.awsglobalaccelerator.com

Software

Resource Hash

2eff1ef7b6768e5f7b659875e3b8d8c426e2446005fb79e10446412403ad45a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
access-control-max-age: 1728000
strict-transport-security: max-age=31556952; includeSubDomains
x-xss-protection: 1; mode=block
x-request-id: 52b0b520b448ffe17ece65d81eb63dc4
x-runtime: 0.011146
x-rp-cache: HIT
referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
etag: W/"2eff1ef7b6768e5f7b659875e3b8d8c4"
x-download-options: noopen
vary: Accept-Encoding
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=300, public
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-headers: Accept, Accept-Encoding, Content-Description, Content-Disposition, Content-Range, Content-Type, Origin, X-Requested-With
expires: Fri, 07 May 2021 17:32:29 GMT

GET
H2 200 RC425b403428db4589a020193bcf2cc140-source.min.js Show response
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/ 2 KB
991 B 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RC425b403428db4589a020193bcf2cc140-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: fac4c46db204bd889e464a6f0eafb1dc763961700bbd4441578acea61d1c46aa

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
last-modified: Fri, 07 May 2021 16:00:54 GMT
server: AkamaiNetStorage
etag: "8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://switchlower.me
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 726
expires: Fri, 07 May 2021 18:28:05 GMT

GET
H2 200 RC4b6623536c3243b7858959f2e7af14d9-source.min.js Show response
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/ 1 KB
901 B 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RC4b6623536c3243b7858959f2e7af14d9-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 83d8ecff1ddd5c63be5338ca0a1130a3009f4a581217407c7eb5960b591420de

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
last-modified: Fri, 07 May 2021 16:00:54 GMT
server: AkamaiNetStorage
etag: "8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://switchlower.me
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 636
expires: Fri, 07 May 2021 18:28:05 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-34118221-1&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 3673
date: Fri, 07 May 2021 16:26:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Fri, 07 May 2021 18:26:52 GMT

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ 81 KB
33 KB 28ms
26ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-2992003&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-34118221-1&l=dataLayer

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b42d9140930e69978c71b2f4637a72c3c715584552be9ad78f3b8328273dca1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33298
x-xss-protection: 0
last-modified: Fri, 07 May 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 07 May 2021 17:28:05 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 45ms
29ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: switchlower.me
URL: https://switchlower.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 3183481f09352eade87e53d32ac3c1f6ab5b853e2b5bde4035834680b53d9299

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
last-modified: Tue, 13 Apr 2021 17:21:02 GMT
x-msedge-ref: Ref A: FF84CD9AA93645AC96CC43E259C7C8C4 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
etag: "0d398608930d71:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8910

GET
H/1.1 403
Forbidden config.json Show response
c.go-mpulse.net/api/ Frame CD2C 68 B
346 B 56ms
42ms XHR
application/json 2a02:26f0:6c00:19a::11a6
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.go-mpulse.net/api/config.json?key=LBAJ4-7RCLK-J6VHB-MN55E-J4AYH&d=switchlower.me&t=5401362&v=1.632.0&if=&sl=0&si=lfn9h5wrlwr-qsqz6t&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,Angular,Backbone,Ember,History,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,LOGN&acao=&ak.ai=294026
Requested by: Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/LBAJ4-7RCLK-J6VHB-MN55E-J4AYH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:6c00:19a::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 3217a6955b600825965f424d1cf73bc156ade880bcb4e16760cfe1771e2da89e

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 07 May 2021 17:28:05 GMT
Cache-Control: public, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 68
Content-Type: application/json

GET
H/1.1 200
OK dest5.html Show response
geico.demdex.net/ Frame 7ECA 7 KB
3 KB 169ms
41ms Document
text/html 34.250.160.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://geico.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.250.160.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-250-160-147.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: geico.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://switchlower.me/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=80437627143179642533706993118307813721
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://switchlower.me/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Fri, 7 May 2021 17:28:05 GMT
DCS: dcs-prod-irl1-1-v005-04d937ff6.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 22 Apr 2021 14:22:49 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: rAB4gkjZTNw=
Content-Length: 2791
Connection: keep-alive

GET
H2 200 id Show response
sadobeanalytics.geico.com/ 48 B
505 B 147ms
35ms XHR
application/x-javascript 15.237.76.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sadobeanalytics.geico.com/id?d_visid_ver=5.2.0&d_fieldgroup=A&mcorgid=71FF20B3534568190A490D45%40AdobeOrg&mid=80541991993212901553681286375836860207&ts=1620408485597

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-76-117.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

693c0b99b3d10d845d4e23e4f49385f3ca54445d6d4ebb03f45d6c45fd0477a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-76898875b9-f5dhx
vary: Origin
x-c: main-1461.Id0ac08.M0-490
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://switchlower.me
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=80437627143179642533706993118307813721
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u

42 B
973 B

41ms
41ms

Image
image/gif

52.30.135.179
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.30.135.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-135-179.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v005-039fc829c.edge-irl1.demdex.com 6.2.1.20210422111706-PR_1432-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: lnTgAH3/TgI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YJV4pQAAAMGtJA_u
Date: Fri, 07 May 2021 17:28:05 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
geico.tt.omtrdc.net/rest/v1/ 278 B
505 B 187ms
82ms XHR
application/json 34.251.77.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geico.tt.omtrdc.net/rest/v1/delivery?client=geico&sessionId=cae3fc0fd95b4e7cb9a840050ace94f5&version=2.4.0
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.77.56 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-77-56.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d58ae704ad171d099f8bfbf270baa32161974f8a598238f15301db25ec83f4a

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://switchlower.me
date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
access-control-allow-credentials: true
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
x-request-id: 15f717b6fb1e9d826c3c5e7d92132067
content-type: application/json;charset=UTF-8

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 27ms
13ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=839458068&t=pageview&_s=1&dl=https%3A%2F%2Fswitchlower.me%2F&ul=en-us&de=UTF-8&dt=An%20Insurance%20Company%20For%20Your%20Car%20And%20More%20%7C%20GEICO&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=4GBAAUABAAAAAC~&jid=1355144418&gjid=2107529534&cid=596866999.1620408486&tid=UA-34118221-1&_gid=465509405.1620408486&_r=1&gtm=2ou4s0&cd1=ga%20pageview%20-%20page%20view&cd2=Static%3AHomePage%3ADefault&cd3=&cd5=&cd7=&cd9=&cd10=&cd11=&cd13=&cd14=unknown&cd16=&cd35=05%2F07%2F2021%2019%3A28%3A05&cd36=-2&cd37=&cd40=https%3A%2F%2Fswitchlower.me%2F&cd41=&cd42=&cd43=&cd44=False&cd45=&cd46=&cd49=&cd50=&cd52=&cd53=&cd54=&cd55=&cd56=&cd57=&cd58=&cd59=&cd60=&cd61=&cd62=&cd63=&cd64=&cd65=&cd67=&cd68=&cd69=&cd70=&cd71=&cd72=&cd73=&cd74=&cd75=&cd78=&cd79=English&cd80=Original&cd81=&cd82=&cd24=&cm8=&cm10=&cm11=&cm12=&cd19=&z=471954823

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://switchlower.me
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefaul... Show response
2992003.fls.doubleclick.net/ Frame B8E5
Redirect Chain

https://2992003.fls.doubleclick.net/activityi;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefa...
https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u1...

557 B
459 B

56ms
31ms

Document
text/html

172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-2992003&l=dataLayer&cx=c

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

c61fd39ef07aabeb2f53fff7048f24fb331da3220ca05b48f5986e7621b37667

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 2992003.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://switchlower.me/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 07 May 2021 17:28:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 434
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 07-May-2021 17:43:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 07 May 2021 17:28:05 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
87 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c04::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-34118221-1&cid=596866999.1620408486&jid=1355144418&gjid=2107529534&_gid=465509405.1620408486&_u=4GBAAUAAAAAAAC~&z=1354167291

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 07 May 2021 17:28:05 GMT
content-type: text/plain
access-control-allow-origin: https://switchlower.me
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 5118357 Show response
bat.bing.com/p/action/ 0
126 B 32ms
31ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/5118357
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 07 May 2021 17:28:05 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: 9939298B5F144AF5B0B6A55DAA8DD714 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
x-powered-by: ARR/3.0

GET
H2 204 0
bat.bing.com/action/ 0
148 B 29ms
29ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5118357&Ver=2&mid=6e0c8184-6b23-4320-9fd1-e633e9a5cc49&sid=954d3c30af5911eb8ece03e36c264b59&vid=954d5eb0af5911eba01669dc7f83441f&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=An%20Insurance%20Company%20For%20Your%20Car%20And%20More%20%7C%20GEICO&p=https%3A%2F%2Fswitchlower.me%2F&r=&lt=1061&evt=pageLoad&msclkid=N&sv=1&rn=79807
Requested by: Host: switchlower.me
URL: https://switchlower.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 07 May 2021 17:28:05 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 4E54373379FA43C6853B9749DDFCA1B8 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
94 B 35ms
35ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5118357&Ver=2&mid=6e0c8184-6b23-4320-9fd1-e633e9a5cc49&sid=954d3c30af5911eb8ece03e36c264b59&vid=954d5eb0af5911eba01669dc7f83441f&vids=0&ec=homepage&el=default&ev=1&ea=goal&en=Y&evt=custom&msclkid=N&rn=687238
Requested by: Host: switchlower.me
URL: https://switchlower.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 07 May 2021 17:28:05 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: CF954FF1C8C84B618EA8165E3991CDBE Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 30ms
30ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-34118221-1&cid=596866999.1620408486&jid=1355144418&_u=4GBAAUAAAAAAAC~&z=103357014

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
29ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j90&tid=UA-34118221-1&cid=596866999.1620408486&jid=1355144418&_u=4GBAAUAAAAAAAC~&z=103357014

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;... Show response
adservice.google.com/ddm/fls/i/ Frame 482E 556 B
503 B 41ms
41ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F

Requested by

Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/activityi;dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2d645f512e2d3f262fe912bb745d171f1ffd5bc940064b6ac0a8f7f8a9e018a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://2992003.fls.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://2992003.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 07 May 2021 17:28:05 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 433
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29

200

dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;... Show response
2992003.fls.doubleclick.net/ddm/fls/r/ Frame BDC5
Redirect Chain

https://adservice.google.de/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u1...
https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u1...

2 KB
1 KB

30ms
30ms

Document
text/html

172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

8795f3f4ee117ffdd061a733d2c514ec91df4fc24fa01d7304401da603a23b92

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 2992003.fls.doubleclick.net
:scheme: https
:path: /ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 07 May 2021 17:28:05 GMT
expires: Fri, 07 May 2021 17:28:05 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 1308
x-xss-protection: 0
set-cookie: IDE=AHWqTUnrqHLLpthz-9eDpoLJEOif3NClvnLGEX2dcAAd5aKx8_5LqJ94mae2rtulxT4; expires=Sun, 07-May-2023 17:28:05 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Fri, 07 May 2021 17:28:05 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
location: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 s76002416697062
sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/ 43 B
224 B 35ms
35ms Image
image/gif 15.237.76.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/s76002416697062?AQB=1&ndh=1&pf=1&t=7%2F4%2F2021%2019%3A28%3A5%205%20-120&sdid=0F49B76A6E83B638-4DA80CFCC7111E14&mid=80541991993212901553681286375836860207&aamlh=6&ce=UTF-8&ns=geico&pageName=Static%3AHomePage%3ADefault&g=https%3A%2F%2Fswitchlower.me%2F&cc=USD&events=event32&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c2=https%3A%2F%2Fswitchlower.me%2F&c5=2.22.0&c14=Non-Mobile%20App%20Experience&c15=v&v15=v&v16=%2B1&v18=Static%3AHomePage%3ADefault&v19=1%3A00PM-Friday&c21=spa%20update%20-%20load%20time%20not%20available&v21=Non-Mobile%20App%20Experience&c28=8.007.1_P&v33=spa%20update%20-%20load%20time%20not%20available&c48=dom%20ready%20page%20view&c50=English&v55=https%3A%2F%2Fswitchlower.me%2F&v74=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F89.0.4389.72%20Safari%2F537.36&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=71FF20B3534568190A490D45%40AdobeOrg&AQE=1

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-76-117.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
x-content-type-options: nosniff
x-c: main-1461.Id0ac08.M0-490
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 08 May 2021 17:28:05 GMT
server: jag
xserver: anedge-76898875b9-qmj55
etag: 3479800725144895488-4621827392094444478
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 06 May 2021 17:28:05 GMT

GET
H2 200 messaging-60e0faac6e7fc4e05ea22dc54f59253efa19d77cd18348db4a13ddfb05cfc701.js Show response
geico.chat.digital.ringcentral.com/assets/ 827 KB
202 KB 105ms
105ms Script
application/javascript 13.248.219.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geico.chat.digital.ringcentral.com/assets/messaging-60e0faac6e7fc4e05ea22dc54f59253efa19d77cd18348db4a13ddfb05cfc701.js
Requested by: Host: geico.chat.digital.ringcentral.com
URL: https://geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.248.219.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa36da1a4932b324f.awsglobalaccelerator.com
Software: /
Resource Hash: 2a04c92b65295ae102f2bcedbd8de8ee7c506a962a691de8f4afa0aa6ac21699

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
last-modified: Wed, 28 Apr 2021 10:27:15 GMT
etag: W/"60893883-ceb99"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ Frame BDC5 43 KB
17 KB 72ms
29ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

f2bc2b36ee0cdf606f492175e7694d827aff1c6fa5dcfcc2f6ca0eb9f031071f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16619
x-xss-protection: 0
server: cafe
etag: 9793835177489279883
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 07 May 2021 17:28:06 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ Frame BDC5 30 KB
9 KB 29ms
29ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 3183481f09352eade87e53d32ac3c1f6ab5b853e2b5bde4035834680b53d9299

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:05 GMT
content-encoding: gzip
last-modified: Tue, 13 Apr 2021 17:21:02 GMT
x-msedge-ref: Ref A: AC7446C8527D488AAF9452C983195EBA Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
etag: "0d398608930d71:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8910

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame BDC5 92 KB
24 KB 65ms
22ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23959
x-fb-rlafr: 0
pragma: public
x-fb-debug: rKlSwu6y+HE9GJON0sFreZbxwZybouhs4IKYi+N5nZWPh4cChlJaiaW318F18xkPfY7tr4ywKQip1BasUlBhfw==
x-fb-trip-id: 19638678
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Fri, 07 May 2021 17:28:06 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 5707359 Show response
bat.bing.com/p/action/ Frame BDC5 0
93 B 30ms
29ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/5707359
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 07 May 2021 17:28:05 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: 238DD0A88C684FDC84E31BDA91FBFA5C Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:05Z
x-powered-by: ARR/3.0

GET
H3-29 200 980746741982743 Show response
connect.facebook.net/signals/config/ Frame BDC5 40 KB
11 KB 76ms
75ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/980746741982743?v=2.9.39&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3bd7e2e819385244407aa5eddb862db6b42cac03a971dd313670df6b39fee349

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: public
x-fb-debug: Zgsjs6kCud1RDGt4sL8LuNVNQi6tlGYjOKDSo+G3XoKClZit5+OMTnXGFp90ncVPk6CbRYCM7ffSzKv/LjZgVg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Fri, 07 May 2021 17:28:06 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071224235/ Frame BDC5 3 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071224235/?random=1620408486043&cv=9&fst=1620408486043&num=1&label=urIBCIWI8QcQq6vm_gM&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=2&url=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&ref=https%3A%2F%2Fadservice.google.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a576e072846cd9478abb333af2a9202360d9dc3bbe775d0386d9161de1fa639f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 17:28:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1246
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ Frame BDC5 0
93 B 28ms
28ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5707359&Ver=2&mid=d9e584d0-ee16-439b-8afb-b3246b0b1453&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&p=https%3A%2F%2Fadservice.google.com%2F&r=&lt=167&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=611782
Requested by: Host: 2992003.fls.doubleclick.net
URL: https://2992003.fls.doubleclick.net/ddm/fls/r/dc_pre=CK7Xu4GMuPACFZhK4AodMLMFiQ;src=2992003;type=retar660;cat=homep837;ord=1;num=2336895041591;gtm=2od4s0;auiddc=1630048557.1620408486;u1=u1;u2=u2;u15=u15;u16=Static%3AHomePage%3ADefault;u17=u17;u18=u18;~oref=https%3A%2F%2Fswitchlower.me%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 07 May 2021 17:28:05 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 04E68A448D214723B7FC79B069B9DB88 Ref B: FRAEDGE1311 Ref C: 2021-05-07T17:28:06Z
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.com/pagead/1p-user-list/1071224235/ Frame BDC5 42 B
64 B 29ms
28ms Image
image/gif 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1071224235/?random=1620408486043&cv=9&fst=1620406800000&num=1&label=urIBCIWI8QcQq6vm_gM&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=1725249624&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 17:28:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.de/pagead/1p-user-list/1071224235/ Frame BDC5 42 B
64 B 30ms
28ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1071224235/?random=1620408486043&cv=9&fst=1620406800000&num=1&label=urIBCIWI8QcQq6vm_gM&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=2&url=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&ref=https%3A%2F%2Fadservice.google.com%2F&fmt=3&is_vtc=1&random=1725249624&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 May 2021 17:28:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame BDC5 44 B
410 B 65ms
22ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=980746741982743&ev=PageView&dl=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&rl=https%3A%2F%2Fadservice.google.com%2F&if=true&ts=1620408486123&sw=1600&sh=1200&v=2.9.39&r=stable&ec=0&o=28&it=1620408486037&coo=false&exp=l1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:06 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 07 May 2021 17:28:06 GMT

GET
H2 200 /
www.facebook.com/tr/ Frame BDC5 44 B
214 B 66ms
23ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=980746741982743&ev=ViewContent&dl=https%3A%2F%2F2992003.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK7Xu4GMuPACFZhK4AodMLMFiQ%3Bsrc%3D2992003%3Btype%3Dretar660%3Bcat%3Dhomep837%3Bord%3D1%3Bnum%3D2336895041591%3Bgtm%3D2od4s0%3Bauiddc%3D1630048557.1620408486%3Bu1%3Du1%3Bu2%3Du2%3Bu15%3Du15%3Bu16%3DStatic%253AHomePage%253ADefault%3Bu17%3Du17%3Bu18%3Du18%3B~oref%3Dhttps%253A%252F%252Fswitchlower.me%252F&rl=https%3A%2F%2Fadservice.google.com%2F&if=true&ts=1620408486128&cd[type]=HomepageDefault&sw=1600&sh=1200&v=2.9.39&r=stable&ec=1&o=28&it=1620408486037&coo=false&exp=l1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://2992003.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:06 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 07 May 2021 17:28:06 GMT

GET
H3-29 200 OrchestratorMain.js Show response
switchlower.me/public/design-kit/4.0/qualtrics/ 79 KB
19 KB 78ms
77ms Script
application/javascript 2606:4700:3036::6815:313b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://switchlower.me/public/design-kit/4.0/qualtrics/OrchestratorMain.js

Requested by

Host: switchlower.me
URL: https://switchlower.me/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:313b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd093e9b0608d6c7f56f32ead8e0fafe244622696db732e8b821e43336fc1ff6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

:path: /public/design-kit/4.0/qualtrics/OrchestratorMain.js
pragma: no-cache
cookie: __cfduid=db4d345d4056d217ef278a035fadfaefe1620408484; at_check=true; RT="z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"; AMCVS_71FF20B3534568190A490D45%40AdobeOrg=1; _ga=GA1.2.596866999.1620408486; _gid=GA1.2.465509405.1620408486; _gat_gtag_UA_34118221_1=1; _gcl_au=1.1.1630048557.1620408486; _uetsid=954d3c30af5911eb8ece03e36c264b59; _uetvid=954d5eb0af5911eba01669dc7f83441f; AMCV_71FF20B3534568190A490D45%40AdobeOrg=-1124106680%7CMCIDTS%7C18755%7CMCMID%7C80541991993212901553681286375836860207%7CMCAAMLH-1621013285%7C6%7CMCAAMB-1621013285%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1620415685s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18762%7CvVersion%7C5.2.0; mbox=session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346|PC#cae3fc0fd95b4e7cb9a840050ace94f5.37_0#1683653286; utm_gpv_pageName=Static%3AHomePage%3ADefault; s_cc=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: switchlower.me
referer: https://switchlower.me/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
x-cdn: Imperva
x-iinfo: 10-13673756-13673757 SNNN RT(1620384797064 14302) q(0 0 0 0) r(1 1) U5
server-timing: cdn-cache; desc=HIT edge; dur=1
vary: Accept-Encoding
cf-request-id: 09e978617900003237ac2e1000000001
last-modified: Fri, 07 May 2021 10:54:31 GMT
server: cloudflare
x-frame-options: sameorigin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZL8tS71ORKI3cmQsaHpPoUE1vWTD18nxkWRmhK8swx8UsGdqyA%2FUpiPcG55QBB9NovaOrF%2FdxrZTEGbhhZHdU5zp%2FE6cHL2asB2oXrmIBuKSeX2NtPl7M%2BOviQ%3D%3D"}]}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
cache-control: max-age=14400
content-security-policy: frame-ancestors 'self'
cf-ray: 64bc29af2c873237-FRA

GET
H2 200 status.js Show response
geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/ 173 B
1 KB 103ms
103ms Script
text/javascript 13.248.219.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://geico.chat.digital.ringcentral.com/chat/1e523f914519776836b9841c/status.js

Requested by

Host: geico.chat.digital.ringcentral.com
URL: https://geico.chat.digital.ringcentral.com/assets/messaging-60e0faac6e7fc4e05ea22dc54f59253efa19d77cd18348db4a13ddfb05cfc701.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.248.219.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

aa36da1a4932b324f.awsglobalaccelerator.com

Software

Resource Hash

2cdc61f9c76d8c6956f07c4a218b06b84ff7dcc3649619083dc752d78f90607b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
access-control-max-age: 1728000
strict-transport-security: max-age=31556952; includeSubDomains
x-xss-protection: 1; mode=block
x-request-id: 8d17300e0c32bfcff860292e9b36de40
x-runtime: 0.018029
x-rp-cache: HIT
referrer-policy: strict-origin-when-cross-origin
x-frame-options: SAMEORIGIN
etag: W/"2cdc61f9c76d8c6956f07c4a218b06b8"
x-download-options: noopen
vary: Accept-Encoding
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=10, public
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-headers: Accept, Accept-Encoding, Content-Description, Content-Disposition, Content-Range, Content-Type, Origin, X-Requested-With
expires: Fri, 07 May 2021 17:28:12 GMT

GET
H2 200 RCb51b55667ea04601bac1abe9ae1cd083-source.min.js Show response
assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/ 372 B
508 B 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:28a::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/c118acf613a5/f856228fd8b7/9f6fd993c67e/RCb51b55667ea04601bac1abe9ae1cd083-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3ae031ef230c4a8191a4ab119cb86733.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28a::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 5fb1c99cc27994d004f3ab66ac87a22f5ed74c56f006e0d19cf4304a4a066668

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:06 GMT
content-encoding: gzip
last-modified: Fri, 07 May 2021 16:00:54 GMT
server: AkamaiNetStorage
etag: "8488e9722994f9fd58fa0784e05be735:1620403254.850401"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://switchlower.me
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 243
expires: Fri, 07 May 2021 18:28:06 GMT

GET
H2 200 s74330515715558
sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/ 43 B
211 B 35ms
35ms Image
image/gif 15.237.76.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sadobeanalytics.geico.com/b/ss/geico-prod/1/JS-2.22.0-LBRU/s74330515715558?AQB=1&ndh=1&pf=1&t=7%2F4%2F2021%2019%3A28%3A6%205%20-120&mid=80541991993212901553681286375836860207&aamlh=6&ce=UTF-8&ns=geico&pageName=Static%3AHomePage%3ADefault&g=https%3A%2F%2Fswitchlower.me%2F&cc=USD&c2=https%3A%2F%2Fswitchlower.me%2F&c5=2.22.0&c14=Non-Mobile%20App%20Experience&c15=v&v15=v&v18=Static%3AHomePage%3ADefault&v21=Non-Mobile%20App%20Experience&c28=8.007.1_P&c48=updatedatanopageturn&c50=English&c53=596866999.1620408486&v55=https%3A%2F%2Fswitchlower.me%2F&v65=Static%3AAgentChat%3ANoAgentsAvailable&v74=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F89.0.4389.72%20Safari%2F537.36&pe=lnk_o&pev2=updatedatanopageturn&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=71FF20B3534568190A490D45%40AdobeOrg&lrt=37&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-76-117.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://switchlower.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 07 May 2021 17:28:06 GMT
x-content-type-options: nosniff
x-c: main-1461.Id0ac08.M0-490
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 08 May 2021 17:28:06 GMT
server: jag
xserver: anedge-76898875b9-wjvrh
etag: 3479800728547459072-4621921973716726464
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 06 May 2021 17:28:06 GMT

Verdicts & Comments Add Verdict or Comment

170 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-20 11:38:00	Name: IDE Value: AHWqTUnrqHLLpthz-9eDpoLJEOif3NClvnLGEX2dcAAd5aKx8_5LqJ94mae2rtulxT4
.switchlower.me/	1969-12-31 23:59:59	Name: s_cc Value: true
.switchlower.me/	1970-01-20 11:40:53	Name: mbox Value: session#cae3fc0fd95b4e7cb9a840050ace94f5#1620410346\|PC#cae3fc0fd95b4e7cb9a840050ace94f5.37_0#1683653286
.demdex.net/	1970-01-19 22:26:00	Name: demdex Value: 80437627143179642533706993118307813721
.switchlower.me/	1970-01-20 11:38:00	Name: AMCV_71FF20B3534568190A490D45%40AdobeOrg Value: -1124106680%7CMCIDTS%7C18755%7CMCMID%7C80541991993212901553681286375836860207%7CMCAAMLH-1621013285%7C6%7CMCAAMB-1621013285%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1620415685s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18762%7CvVersion%7C5.2.0
.switchlower.me/	1970-01-19 20:16:24	Name: _gcl_au Value: 1.1.1630048557.1620408486
.switchlower.me/	1970-01-19 18:06:48	Name: _gat_gtag_UA_34118221_1 Value: 1
.switchlower.me/	1970-01-19 18:08:14	Name: _gid Value: GA1.2.465509405.1620408486
.switchlower.me/	1970-01-20 11:38:00	Name: _ga Value: GA1.2.596866999.1620408486
.switchlower.me/	1970-01-19 18:06:50	Name: utm_gpv_pageName Value: Static%3AHomePage%3ADefault
.switchlower.me/	1969-12-31 23:59:59	Name: AMCVS_71FF20B3534568190A490D45%40AdobeOrg Value: 1
.switchlower.me/	1970-01-19 18:08:14	Name: _uetsid Value: 954d3c30af5911eb8ece03e36c264b59
.switchlower.me/	1970-01-19 18:16:53	Name: RT Value: "z=1&dm=switchlower.me&si=lfn9h5wrlwr&ss=koeldh27&sl=0&tt=0"
.switchlower.me/	1969-12-31 23:59:59	Name: at_check Value: true
.switchlower.me/	1970-01-19 18:30:12	Name: _uetvid Value: 954d5eb0af5911eba01669dc7f83441f
.switchlower.me/	1970-01-19 18:50:00	Name: __cfduid Value: db4d345d4056d217ef278a035fadfaefe1620408484

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	(Line 2) Message: bing pixel reached

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2992003.fls.doubleclick.net
adservice.google.com
adservice.google.de
assets.adobedtm.com
bat.bing.com
c.go-mpulse.net
cm.everesttech.net
connect.facebook.net
dpm.demdex.net
geico.chat.digital.ringcentral.com
geico.demdex.net
geico.tt.omtrdc.net
googleads.g.doubleclick.net
s.go-mpulse.net
sadobeanalytics.geico.com
stats.g.doubleclick.net
switchlower.me
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
13.248.219.41
15.237.76.117
172.217.16.134
172.217.23.98
2606:4700:3036::6815:313b
2620:1ec:c11::200
2a00:1450:4001:803::2003
2a00:1450:4001:808::2004
2a00:1450:4001:80e::2004
2a00:1450:4001:811::2008
2a00:1450:4001:813::2002
2a00:1450:4001:829::200e
2a00:1450:400c:c04::9a
2a02:26f0:6c00:19a::11a6
2a02:26f0:6c00:287::11a6
2a02:26f0:6c00:28a::1e80
2a03:2880:f008:8:face:b00c:0:1
2a03:2880:f108:83:face:b00c:0:25de
34.250.160.147
34.251.77.56
34.255.166.243
52.30.135.179
02515ee3f986616cc4c0002e575e48e18590e77869a3a3d2d60136bb45a49c6b
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2a04c92b65295ae102f2bcedbd8de8ee7c506a962a691de8f4afa0aa6ac21699
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2cdc61f9c76d8c6956f07c4a218b06b84ff7dcc3649619083dc752d78f90607b
2eff1ef7b6768e5f7b659875e3b8d8c426e2446005fb79e10446412403ad45a5
3183481f09352eade87e53d32ac3c1f6ab5b853e2b5bde4035834680b53d9299
3217a6955b600825965f424d1cf73bc156ade880bcb4e16760cfe1771e2da89e
3394c09a692efd1a3d777125b9802b11582b53ff86390951b47f526a0c9baa04
35356a15f7cd1664f1da8ae6e5d0cd6e573a25b40c5e7c9ea31aa69e93a8b1e3
395f845728799f09f018fed5c842d831286a819584253df9e588d8ad733a32b0
3bd7e2e819385244407aa5eddb862db6b42cac03a971dd313670df6b39fee349
3bf5254dbd435444aae1d45cdcdbf10cec495b78b8d752a1acc5c1b566d97632
47a3e3b64cffe3ff820ebe554ac4df940da5ed469eaddbbc13bdd3b0b1eb4479
4942742285c81ae389c8e777cf0863a46ad8d2e3c64d97ee500a4529290e4927
4f6a9c99d36c51fabdd3e290c6a7fafb8252e6f34627d37d133ee9381a7880e5
50e2012d10fecd1d38c717dc5d3d4f6023dbc57808e366073a2b200186c170d0
5fb1c99cc27994d004f3ab66ac87a22f5ed74c56f006e0d19cf4304a4a066668
63413259cbaefb160e5ade88d65669a85beb447007edb1eb6f58daeba865822e
693c0b99b3d10d845d4e23e4f49385f3ca54445d6d4ebb03f45d6c45fd0477a7
7812342c0b0cbd5d699200f898538345f1ff23516280121e9916e1fc915b0770
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7d0b5bd193c90a7a7137fa4b7243191e88ab993ec428fd7112bc4bad5da49267
83d8ecff1ddd5c63be5338ca0a1130a3009f4a581217407c7eb5960b591420de
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8795f3f4ee117ffdd061a733d2c514ec91df4fc24fa01d7304401da603a23b92
8d58ae704ad171d099f8bfbf270baa32161974f8a598238f15301db25ec83f4a
926c2f23ee30acb05d85b0f176a502e86d4d767ed750ed35efe2787fb5e52847
95a439c4e11ace2484e8d42c30ff56cf7db5ea7c6463df9ce2fdafa7f6ccbf54
98cf2519495224f38de05c45472bed5960643518e8dfd8aceee77bd3701f872c
9d7f13a127f5e543f983ffa8c106b7e708c20a6ddfbf205d2cd0178e8572a3cb
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a517525b8a7d39bcaf1cf5f9695c5be8fce7a6b920a3924c1a4f70e8ea748c05
a576e072846cd9478abb333af2a9202360d9dc3bbe775d0386d9161de1fa639f
a6135d6c9e52110c5bebdc942bc27c30004ef47f5bc05f390212a35da68c3ad5
b2d645f512e2d3f262fe912bb745d171f1ffd5bc940064b6ac0a8f7f8a9e018a
b42d9140930e69978c71b2f4637a72c3c715584552be9ad78f3b8328273dca1d
b6b19992ce19edffbf47e2e0e2700e15779ab8c0961b4375b3473a6d97267bb1
bcd6d6544b04396263538bcbdc14c305491cf039b8f0a1e826601964597c26d4
c16083359eec24e8fecdd8bfed214525be923db82ef853b5cd5d9105f5361254
c61fd39ef07aabeb2f53fff7048f24fb331da3220ca05b48f5986e7621b37667
d3f2c447994284b8fceb218aea1be93ed8640335ce15eb100188a5cb52179970
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d79217c6457a51cac79e8b968475030bd8b7e8de9d86b00f061233ff37871177
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e02c6c70d246d353fc47a1ed35d6dd3214bcc536e8b695f86c386d9d52423de5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb304a59575d781637c1129287d5b5ad03937c584953e24167266370f015387
f2bc2b36ee0cdf606f492175e7694d827aff1c6fa5dcfcc2f6ca0eb9f031071f
fac4c46db204bd889e464a6f0eafb1dc763961700bbd4441578acea61d1c46aa
fd093e9b0608d6c7f56f32ead8e0fafe244622696db732e8b821e43336fc1ff6

switchlower.me Open in urlscan Pro 2606:4700:3036::6815:313b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

64 Requests

100 %HTTPS

64 %IPv6

17 Domains

23 Subdomains

22 IPs

6 Countries

900 kBTransfer

3219 kBSize

16 Cookies

36 Outgoing links

Page URL History

Redirected requests

64 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

switchlower.me Open in urlscan Pro
2606:4700:3036::6815:313b Public Scan

Screenshot
Live screenshot

Full Image

64
Requests

100 %
HTTPS

64 %
IPv6

17
Domains

23
Subdomains

22
IPs

6
Countries

900 kB
Transfer

3219 kB
Size

16
Cookies

64 HTTP transactions
1 data transactions