ua-tracer by Paul Kinlan

ua-tracer

what does a user agent actually fetch, follow & run?

← all traces

Trace IPZqB5JN

First seen: 2026-07-02 18:33:20.470 UTC
User-Agent: Mozilla/5.0 (compatible; DemoBot/1.0; +https://example.com)
Bot verification: Not a known bot (no IP-range check applies).

What this user agent did

Directly-referenced assets:

✓ fetched CSS ✓ fetched JS ✓ fetched image ✗ fetched font (HTML)

Document-level link hints:

✗ fetched favicon ✗ fetched apple-touch-icon ✗ fetched web manifest ✗ fetched preload ✗ fetched prefetch

Second-level follows (proves it parsed the linking file):

✓ followed CSS background-image ✓ followed CSS @font-face ✗ followed manifest icon ✗ followed CSS @import

Frames (does it descend into iframes?):

✗ fetched iframe document ✗ descended into iframe (loaded inner image)

Reporting (a report-only CSP is violated by inline styles; reports can arrive via HTTP headers with no JS, or via in-page beacons):

✗ sent a CSP/Reporting report (any path) ✗ delivered via report-uri/Report-To header (no JS) ✗ delivered via in-page beacon (securitypolicyviolation / ReportingObserver)

Social embed (Open Graph / Twitter card images):

✗ fetched og:image ✗ fetched twitter:image

JavaScript execution:

✓ EXECUTED classic JS ✗ EXECUTED ES module ✓ posted client timing

Server-side request waterfall

Every request the server received for this trace, in receive order. +ms is the delta from the homepage request.

ReceivedΔKindMethodUser-Agent
2026-07-02 18:33:20.470 UTC +0 ms homepage GET Mozilla/5.0 (compatible; DemoBot/1.0; +https://example.com)
request headers (6) 
{
  "accept": "*/*",
  "host": "uatracer.com",
  "traceparent": "00-b6554fb7686b669bef6cc51006118b6a-3f9e1658e2010704-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (compatible; DemoBot/1.0; +https://example.com)",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-02 18:33:22.088 UTC +1618 ms CSS GET curl/8.20.0
request headers (8) 
{
  "accept": "*/*",
  "host": "uatracer.com",
  "traceparent": "00-7cf006ce6e4895ce5318a4a3e3efbc93-5b7983a9832e137e-01",
  "tracestate": "",
  "user-agent": "curl/8.20.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net",
  "x-deno-userspace-traceparent": "00-7cf006ce6e4895ce5318a4a3e3efbc93-09d9307a750da4ad-01",
  "x-deno-userspace-tracestate": ""
}
2026-07-02 18:33:22.980 UTC +2510 ms JS GET curl/8.20.0
request headers (6) 
{
  "accept": "*/*",
  "host": "uatracer.com",
  "traceparent": "00-fc3348e9780699398c63bc41fdc5b9b2-dba982e958f150d9-01",
  "tracestate": "",
  "user-agent": "curl/8.20.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-02 18:33:23.916 UTC +3446 ms CSS background-image GET curl/8.20.0
request headers (8) 
{
  "accept": "*/*",
  "host": "uatracer.com",
  "traceparent": "00-99c2a49ae5d3667c8d89451124483859-f88c3ab45621d8e7-01",
  "tracestate": "",
  "user-agent": "curl/8.20.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net",
  "x-deno-userspace-traceparent": "00-99c2a49ae5d3667c8d89451124483859-5fee034568410397-01",
  "x-deno-userspace-tracestate": ""
}
2026-07-02 18:33:24.812 UTC +4342 ms CSS @font-face GET curl/8.20.0
request headers (6) 
{
  "accept": "*/*",
  "host": "uatracer.com",
  "traceparent": "00-21e5fc4dbdaa328e945c61c6149a7c96-b1f0bd8728c0e219-01",
  "tracestate": "",
  "user-agent": "curl/8.20.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-02 18:33:25.726 UTC +5256 ms JS executed beacon GET curl/8.20.0
request headers (8) 
{
  "accept": "*/*",
  "host": "uatracer.com",
  "traceparent": "00-cfca74227fc1c39f1347c8b7d6aff40b-465a6fd628ecf98f-01",
  "tracestate": "",
  "user-agent": "curl/8.20.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net",
  "x-deno-userspace-traceparent": "00-cfca74227fc1c39f1347c8b7d6aff40b-7aa0dcd67c511556-01",
  "x-deno-userspace-tracestate": ""
}
2026-07-02 18:33:26.622 UTC +6152 ms image GET curl/8.20.0
request headers (6) 
{
  "accept": "*/*",
  "host": "uatracer.com",
  "traceparent": "00-99e744e64e7964b9b5b7d5e22a57f656-4757318af02c8d41-01",
  "tracestate": "",
  "user-agent": "curl/8.20.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-02 18:33:27.520 UTC +7050 ms client timing POST POST curl/8.20.0
request headers (8) 
{
  "accept": "*/*",
  "content-length": "1216",
  "content-type": "application/json",
  "host": "uatracer.com",
  "traceparent": "00-f500e88d26186f628870289f7a14534c-ce0dd76003d25447-01",
  "tracestate": "",
  "user-agent": "curl/8.20.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}

Client-side resource waterfall

Reported by performance.getEntriesByType('resource') after JS ran in the UA. This proves a real browser-grade engine, not just a downloader.

ResourceInitiatorStartDurationTimeline
https://uatracer.com/ other 0ms 142ms
style.css css 18ms 34ms
main.js script 19ms 41ms
font.woff2 css 21ms 88ms
photo.png img 60ms 22ms
css-bg.png css 95ms 15ms
css-font.woff2 css 110ms 30ms
js-ran.gif script 130ms 6ms