ua-tracer
by Paul Kinlan
ua-tracer
what does a user agent actually fetch, follow & run?
Trace WKAFxoXs
First seen: 2026-06-28 20:41:54.784 UTC
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 WAVE-Accessibility/3.3 (+https://wave.webaim.org)
What this user agent did
Directly-referenced assets:
✓ fetched CSS
✓ fetched JS
✓ fetched image
✓ fetched font (HTML)
Document-level link hints:
✗ fetched favicon
✗ fetched apple-touch-icon
✗ fetched web manifest
✓ fetched preload
✓ fetched prefetch
Second-level follows (proves it parsed the linking file):
✓ followed CSS background-image
✓ followed CSS @font-face
✗ followed manifest icon
✓ followed CSS @import
Frames (does it descend into iframes?):
✓ fetched iframe document
✓ descended into iframe (loaded inner image)
Reporting (a report-only CSP is violated by inline styles; reports can arrive via HTTP headers with no JS, or via in-page beacons):
✗ sent a CSP/Reporting report (any path)
✗ delivered via report-uri/Report-To header (no JS)
✗ delivered via in-page beacon (securitypolicyviolation / ReportingObserver)
Social embed (Open Graph / Twitter card images):
✗ fetched og:image
✗ fetched twitter:image
JavaScript execution:
✓ EXECUTED classic JS
✗ EXECUTED ES module
✗ posted client timing
Server-side request waterfall
Every request the server received for this trace, in receive order. +ms is the delta from the
homepage request.
| Received | Δ | Kind | Method | User-Agent |
|---|---|---|---|---|
| 2026-06-28 20:41:54.784 UTC | +0 ms | homepage | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 WAVE-Accessibility/3.3 (+https://wave.webaim.org) |
request headers (7){
"accept": "*/*",
"accept-encoding": "gzip,deflate,compress",
"host": "uatracer.com",
"traceparent": "00-d40408c6b448fa2eb3f134d5b19b4777-5de0262781dc3115-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 WAVE-Accessibility/3.3 (+https://wave.webaim.org)",
"via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.098 UTC | +1314 ms | CSS | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "text/css,*/*;q=0.1",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "u=0",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "style",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-f987a865a5b6a83545bde105cbc93cce-84ac8330cbcb4968-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.102 UTC | +1318 ms | image | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "i",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "image",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-e9c65ee679b92e377de9ae760adca5f7-34ac51dfb4882ad1-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.102 UTC | +1318 ms | JS | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "u=1",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "script",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-c27975d5dbc6a0dfaa9b2afe44e744ad-b35cb3221b4a9239-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.103 UTC | +1319 ms | font (HTML) | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"origin": "https://wave.webaim.org",
"priority": "u=1",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "font",
"sec-fetch-mode": "cors",
"sec-fetch-site": "cross-site",
"traceparent": "00-8e7708327e8a4d948fc6376d70f006cb-30e808ee22d32efc-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.103 UTC | +1319 ms | preload (image) | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "i",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "image",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-35b5f79ba0b5aa698e86e786851db1c6-4268c15e5269f7a5-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.104 UTC | +1320 ms | iframe document | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (18){
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "u=0, i",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "iframe",
"sec-fetch-mode": "navigate",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-1e51ad536160bf3f9746685f0fdcb7f8-5294b5c90ef179ac-01",
"tracestate": "",
"upgrade-insecure-requests": "1",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.107 UTC | +1323 ms | ES module | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"origin": "https://wave.webaim.org",
"priority": "u=1",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "script",
"sec-fetch-mode": "cors",
"sec-fetch-site": "cross-site",
"traceparent": "00-2b97491f62fa36fd492e3941a84c6366-b6d9a057d3632447-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:56.769 UTC | +1985 ms | prefetch | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (18){
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "u=4, i",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "empty",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"sec-purpose": "prefetch",
"traceparent": "00-78b2a91a6fd84d746e0976265ed8bff7-bc70a430172c4355-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:58.457 UTC | +3673 ms | image inside iframe | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "i",
"referer": "https://uatracer.com/r/WKAFxoXs/VjOJvBXB/iframe",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "image",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "same-origin",
"sec-fetch-storage-access": "none",
"traceparent": "00-1c6b5783a1825d7c4b830aabf2211a66-1a9c51f02985faff-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:58.831 UTC | +4047 ms | CSS @import (nested stylesheet) | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "text/css,*/*;q=0.1",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "u=0",
"referer": "https://uatracer.com/r/WKAFxoXs/VjOJvBXB/style.css",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "style",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-001c449abb63d36f3aadcb91f6b793b4-bb934227b2d4613e-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:59.454 UTC | +4670 ms | JS executed beacon | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "i",
"referer": "https://wave.webaim.org/",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "image",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-36bfbbe3fba194c696e509a5e1adcd14-6db3111e7e3f81ab-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:41:59.458 UTC | +4674 ms | CSS background-image | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"priority": "i",
"referer": "https://uatracer.com/r/WKAFxoXs/VjOJvBXB/style.css",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "image",
"sec-fetch-mode": "no-cors",
"sec-fetch-site": "cross-site",
"sec-fetch-storage-access": "none",
"traceparent": "00-30ad6b57f401ef80c1d83aaf3ffd50dd-3b04a773b601b36b-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:42:00.154 UTC | +5370 ms | CSS @font-face | GET | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"host": "uatracer.com",
"origin": "https://wave.webaim.org",
"priority": "u=0",
"referer": "https://uatracer.com/r/WKAFxoXs/VjOJvBXB/style.css",
"sec-ch-ua": "\"Not=A?Brand\";v=\"99\", \"Google Chrome\";v=\"151\", \"Chromium\";v=\"151\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "font",
"sec-fetch-mode": "cors",
"sec-fetch-site": "cross-site",
"traceparent": "00-4446ee29e09ae5ffeb0321b078d7d332-102701af41455b87-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
| 2026-06-28 20:42:02.570 UTC | +7786 ms | client timing POST | OPTIONS | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 |
request headers (17){
"accept": "*/*",
"accept-encoding": "gzip, deflate, br, zstd",
"accept-language": "en-GB,en-US;q=0.9,en;q=0.8,cy;q=0.7,ja;q=0.6",
"access-control-request-headers": "content-type",
"access-control-request-method": "POST",
"content-length": "0",
"host": "uatracer.com",
"origin": "https://wave.webaim.org",
"priority": "u=4, i",
"referer": "https://wave.webaim.org/",
"sec-fetch-dest": "empty",
"sec-fetch-mode": "cors",
"sec-fetch-site": "cross-site",
"traceparent": "00-f89fa1bde3b9f4480842364d2c76a957-32e69e4076e99592-01",
"tracestate": "",
"user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36",
"via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
|
||||
Client-side resource waterfall
JS executed (beacon hit) but no resource-timing payload was posted (UA may block sendBeacon/fetch or strip the body).