ua-tracer
by Paul Kinlan
trace PLYLZWsN
what does a user agent actually fetch, follow & run?
Trace PLYLZWsN
First seen: 2026-07-14 03:23:12.585 UTC
User-Agent: pc
Bot verification: Not a known bot (no IP-range check applies).
What this user agent did
Directly-referenced assets:
✗ fetched CSS
✓ fetched JS
✓ fetched image
✓ fetched font (HTML)
Document-level link hints:
✗ fetched favicon
✗ fetched apple-touch-icon
✗ fetched web manifest
✓ fetched preload
✓ fetched prefetch
Second-level follows (proves it parsed the linking file):
✗ followed CSS background-image
✗ followed CSS @font-face
✗ followed manifest icon
✗ followed CSS @import
Frames (does it descend into iframes?):
✓ fetched iframe document
✗ descended into iframe (loaded inner image)
Reporting (a report-only CSP is violated by inline styles; reports can arrive via HTTP headers with no JS, or via in-page beacons):
✗ sent a CSP/Reporting report (any path)
✗ delivered via report-uri/Report-To header (no JS)
✗ delivered via in-page beacon (securitypolicyviolation / ReportingObserver)
Social embed (Open Graph / Twitter card images):
✗ fetched og:image
✗ fetched twitter:image
JavaScript execution:
✓ EXECUTED classic JS
✓ EXECUTED ES module
✓ posted client timing
Server-side request waterfall
Every request the server received for this trace, in receive order. +ms is the delta from the
homepage request.
| Received | Δ | Kind | Method | User-Agent |
|---|---|---|---|---|
| 2026-07-14 03:23:12.585 UTC | +0 ms | homepage | GET | pc |
request headers (20){
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "zh-CN",
"cache-control": "no-cache",
"host": "uatracer.com",
"pragma": "no-cache",
"priority": "u=0, i",
"referer": "http://m.baidu.com/s?wd=bankzro",
"sec-ch-ua": "\"Chromium\";v=\"134\", \"Not:A-Brand\";v=\"24\", \"HeadlessChrome\";v=\"134\"",
"sec-ch-ua-mobile": "?1",
"sec-ch-ua-platform": "\"Windows\"",
"sec-fetch-dest": "document",
"sec-fetch-mode": "navigate",
"sec-fetch-site": "none",
"sec-fetch-user": "?1",
"traceparent": "00-ed8fa880faf6b81727ff4421894e33f3-f847f97f0bd1f303-01",
"tracestate": "",
"upgrade-insecure-requests": "1",
"user-agent": "pc",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-14 03:23:15.802 UTC | +3217 ms | prefetch | GET | pc |
request headers (20){
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "zh-CN,zh",
"cache-control": "no-cache",
"cookie": "ua-tracer-trace=PLYLZWsN",
"host": "uatracer.com",
"pragma": "no-cache",
"priority": "u=4, i",
"purpose": "prefetch",
"referer": "http://m.baidu.com/s?wd=bankzro",
"sec-ch-ua": "\"Chromium\";v=\"134\", \"Not:A-Brand\";v=\"24\", \"HeadlessChrome\";v=\"134\"",
"sec-ch-ua-mobile": "?1",
"sec-ch-ua-platform": "\"Windows\"",
"sec-fetch-dest": "empty",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "same-origin",
"traceparent": "00-4adbb9851b135614bb0c19c544f53b5c-9d10d23b7baf5e95-01",
"tracestate": "",
"user-agent": "pc",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-14 03:23:15.999 UTC | +3414 ms | iframe document | GET | pc |
request headers (20){
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "zh-CN",
"cache-control": "no-cache",
"cookie": "ua-tracer-trace=PLYLZWsN",
"host": "uatracer.com",
"pragma": "no-cache",
"priority": "u=0, i",
"referer": "https://uatracer.com/",
"sec-ch-ua": "\"Chromium\";v=\"134\", \"Not:A-Brand\";v=\"24\", \"HeadlessChrome\";v=\"134\"",
"sec-ch-ua-mobile": "?1",
"sec-ch-ua-platform": "\"Windows\"",
"sec-fetch-dest": "iframe",
"sec-fetch-mode": "navigate",
"sec-fetch-site": "same-origin",
"traceparent": "00-b497784c6eb5b3e9f09548efae126ddb-8f5063f87a0623f5-01",
"tracestate": "",
"upgrade-insecure-requests": "1",
"user-agent": "pc",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-14 03:23:16.010 UTC | +3425 ms | JS | GET | pc |
request headers (19){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "zh-CN,zh",
"cache-control": "no-cache",
"cookie": "ua-tracer-trace=PLYLZWsN",
"host": "uatracer.com",
"pragma": "no-cache",
"priority": "u=1",
"referer": "http://m.baidu.com/s?wd=bankzro",
"sec-ch-ua": "\"Chromium\";v=\"134\", \"Not:A-Brand\";v=\"24\", \"HeadlessChrome\";v=\"134\"",
"sec-ch-ua-mobile": "?1",
"sec-ch-ua-platform": "\"Windows\"",
"sec-fetch-dest": "script",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "same-origin",
"traceparent": "00-e97811b0e334ef75327bc847e506ee29-96626746bc8ddf0c-01",
"tracestate": "",
"user-agent": "pc",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-14 03:23:16.095 UTC | +3510 ms | ES module | GET | pc |
request headers (20){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "zh-CN,zh",
"cache-control": "no-cache",
"cookie": "ua-tracer-trace=PLYLZWsN",
"host": "uatracer.com",
"origin": "https://uatracer.com",
"pragma": "no-cache",
"priority": "u=1",
"referer": "http://m.baidu.com/s?wd=bankzro",
"sec-ch-ua": "\"Chromium\";v=\"134\", \"Not:A-Brand\";v=\"24\", \"HeadlessChrome\";v=\"134\"",
"sec-ch-ua-mobile": "?1",
"sec-ch-ua-platform": "\"Windows\"",
"sec-fetch-dest": "script",
"sec-fetch-mode": "cors",
"sec-fetch-site": "same-origin",
"traceparent": "00-1660f4c82a3db21f47a26be64b70bc52-dbfa86f8e8642994-01",
"tracestate": "",
"user-agent": "pc",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-14 03:23:20.332 UTC | +7747 ms | client timing POST | POST | pc |
request headers (22){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "zh-CN,zh",
"cache-control": "no-cache",
"content-length": "1684",
"content-type": "application/json",
"cookie": "ua-tracer-trace=PLYLZWsN",
"host": "uatracer.com",
"origin": "https://uatracer.com",
"pragma": "no-cache",
"priority": "u=4, i",
"referer": "http://m.baidu.com/s?wd=bankzro",
"sec-ch-ua": "\"Chromium\";v=\"134\", \"Not:A-Brand\";v=\"24\", \"HeadlessChrome\";v=\"134\"",
"sec-ch-ua-mobile": "?1",
"sec-ch-ua-platform": "\"Windows\"",
"sec-fetch-dest": "empty",
"sec-fetch-mode": "cors",
"sec-fetch-site": "same-origin",
"traceparent": "00-bc7c2fa5a8fe1e3fb78b19905f3719de-d0620079631f4a32-01",
"tracestate": "",
"user-agent": "pc",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-14 10:28:41.833 UTC | +25529248 ms | font (HTML) | GET | Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1 |
request headers (12){
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"accept-encoding": "gzip",
"accept-language": "zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7",
"cache-control": "no-cache",
"connection": "keep-alive, close",
"host": "uatracer.com",
"pragma": "no-cache",
"traceparent": "00-328bc0647fc019ce6d744f8a5b20c315-81195f0b4adea9bf-01",
"tracestate": "",
"upgrade-insecure-requests": "1",
"user-agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1",
"via": "HTTP/1.1 ord.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-15 12:43:48.939 UTC | +120036354 ms | image | GET | Python/3.12 aiohttp/3.12.15 |
request headers (7){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br",
"host": "uatracer.com",
"traceparent": "00-d7c6d7a7a0d4b29c5a7c022f21e91695-9f507e91aaaa4204-01",
"tracestate": "",
"user-agent": "Python/3.12 aiohttp/3.12.15",
"via": "HTTP/1.1 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-15 12:44:10.745 UTC | +120058160 ms | prefetch | GET | Python/3.12 aiohttp/3.12.15 |
request headers (7){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br",
"host": "uatracer.com",
"traceparent": "00-025d8ae8b1ea3ecc7acf34d308e26e2f-a5c75a1ec0bcc47c-01",
"tracestate": "",
"user-agent": "Python/3.12 aiohttp/3.12.15",
"via": "HTTP/1.1 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-15 12:44:10.829 UTC | +120058244 ms | preload (image) | GET | Python/3.12 aiohttp/3.12.15 |
request headers (7){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br",
"host": "uatracer.com",
"traceparent": "00-66413e1fef793420d3e21c4d6fa51254-ccf200dffedebe91-01",
"tracestate": "",
"user-agent": "Python/3.12 aiohttp/3.12.15",
"via": "HTTP/1.1 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-17 15:29:04.535 UTC | +302751950 ms | iframe document | GET | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 |
request headers (9){
"accept-encoding": "gzip,deflate",
"connection": "close",
"host": "uatracer.com",
"traceparent": "00-588581df24460b9b39edc2d60b68b7f4-7f4064e822d8c1c8-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36",
"via": "HTTP/1.1 ord.vultr.prod.deno-cluster.net",
"x-deno-userspace-traceparent": "00-588581df24460b9b39edc2d60b68b7f4-c11867452e7051c4-01",
"x-deno-userspace-tracestate": ""
}
|
||||
| 2026-07-17 16:43:00.686 UTC | +307188101 ms | JS executed beacon | GET | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 |
request headers (7){
"accept-encoding": "gzip,deflate",
"connection": "close",
"host": "uatracer.com",
"traceparent": "00-0ada0c07ee38e5bc4939c12429535a8e-94ec906cd637ee2a-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36",
"via": "HTTP/1.1 ord.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-17 16:43:13.148 UTC | +307200563 ms | ES module executed | GET | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 |
request headers (9){
"accept-encoding": "gzip,deflate",
"connection": "close",
"host": "uatracer.com",
"traceparent": "00-c1ee67c3eac93b6380e746fc7c72fc28-d03fc06f59f86f04-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36",
"via": "HTTP/1.1 ord.vultr.prod.deno-cluster.net",
"x-deno-userspace-traceparent": "00-c1ee67c3eac93b6380e746fc7c72fc28-c00facfe5d423eba-01",
"x-deno-userspace-tracestate": ""
}
|
||||
| 2026-07-17 18:46:30.885 UTC | +314598300 ms | preload (image) | GET | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 |
request headers (7){
"accept-encoding": "gzip,deflate",
"connection": "close",
"host": "uatracer.com",
"traceparent": "00-353a440d1766f3cd5bd4de15d57964de-815308eaf8310dc1-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36",
"via": "HTTP/1.1 ord.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-17 20:53:26.115 UTC | +322213530 ms | image | GET | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 |
request headers (7){
"accept-encoding": "gzip,deflate",
"connection": "close",
"host": "uatracer.com",
"traceparent": "00-1c706ba0b3bbb1c143b0dd029bf75c3a-79d0db1269d0790a-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36",
"via": "HTTP/1.1 ord.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-07-17 21:32:27.468 UTC | +324554883 ms | prefetch | GET | Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36 |
request headers (7){
"accept-encoding": "gzip,deflate",
"connection": "close",
"host": "uatracer.com",
"traceparent": "00-b34534f2ea0cc7bb76797588b5a78417-23219b77d6241b3b-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36",
"via": "HTTP/1.1 ord.vultr.prod.deno-cluster.net"
}
|
||||
Client-side resource waterfall
Reported by performance.getEntriesByType('resource') after JS ran in the UA. This proves a real
browser-grade engine, not just a downloader.
| Resource | Initiator | Start | Duration | Timeline |
|---|---|---|---|---|
| link | 4119ms | 783ms | ||
| link | 4120ms | 788ms | ||
| link | 4120ms | 791ms | ||
| link | 4123ms | 1606ms | ||
| iframe | 4508ms | 2087ms | ||
| img | 4509ms | 519ms | ||
| script | 4509ms | 1725ms | ||
| script | 4510ms | 1512ms | ||
| img | 6305ms | 515ms | ||
| img | 6317ms | 695ms |