ua-tracer by Paul Kinlan

ua-tracer

what does a user agent actually fetch, follow & run?

← all traces

Trace cBpeAjMj

First seen: 2026-07-03 04:30:22.504 UTC
User-Agent: Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
Bot verification: Not a known bot (no IP-range check applies).

What this user agent did

Directly-referenced assets:

✓ fetched CSS ✓ fetched JS ✓ fetched image ✓ fetched font (HTML)

Document-level link hints:

✗ fetched favicon ✗ fetched apple-touch-icon ✓ fetched web manifest ✓ fetched preload ✗ fetched prefetch

Second-level follows (proves it parsed the linking file):

✓ followed CSS background-image ✓ followed CSS @font-face ✗ followed manifest icon ✓ followed CSS @import

Frames (does it descend into iframes?):

✓ fetched iframe document ✓ descended into iframe (loaded inner image)

Reporting (a report-only CSP is violated by inline styles; reports can arrive via HTTP headers with no JS, or via in-page beacons):

✗ sent a CSP/Reporting report (any path) ✗ delivered via report-uri/Report-To header (no JS) ✗ delivered via in-page beacon (securitypolicyviolation / ReportingObserver)

Social embed (Open Graph / Twitter card images):

✗ fetched og:image ✗ fetched twitter:image

JavaScript execution:

✓ EXECUTED classic JS ✓ EXECUTED ES module ✗ posted client timing

Server-side request waterfall

Every request the server received for this trace, in receive order. +ms is the delta from the homepage request.

ReceivedΔKindMethodUser-Agent
2026-07-03 04:30:22.504 UTC +0 ms homepage GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=0, i",
  "sec-fetch-dest": "document",
  "sec-fetch-mode": "navigate",
  "sec-fetch-site": "none",
  "sec-fetch-user": "?1",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-2d3155b94b75e9827ca78550109331b2-87cd28070966b53c-01",
  "tracestate": "",
  "upgrade-insecure-requests": "1",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:25.429 UTC +2925 ms preload (image) GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=5, i",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-b059088f405cc163eb1e5f98da40e72b-cdf3500b4a5f13d8-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:25.430 UTC +2926 ms JS GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (16) 
{
  "accept": "*/*",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "script",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-5b3ee0e6f31d0f11c88e88a42fac5c59-00db482c10d03d38-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:25.430 UTC +2926 ms image GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=5, i",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-0892b57ff066ec7aeeef70fc25739e3f-9b1f5f1344ec7de9-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:25.430 UTC +2926 ms font (HTML) GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=2",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "font",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-d8711f2a185f3f2d4c66145070177795-dffaefe33648acac-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:25.431 UTC +2927 ms ES module GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (16) 
{
  "accept": "*/*",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "script",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-4d50bce367d6a8f96125849308f40a90-cf88ac6d21148471-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:25.431 UTC +2927 ms CSS GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "text/css,*/*;q=0.1",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=2",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "style",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-efd2296d2f400bba636c20357bfec7e4-1f58846b7a7b291b-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:25.671 UTC +3167 ms iframe document GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (18) 
{
  "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=4",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "iframe",
  "sec-fetch-mode": "navigate",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-82025cbf6151b353465ac84009499164-acf65660c89ed1e9-01",
  "tracestate": "",
  "upgrade-insecure-requests": "1",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:26.908 UTC +4404 ms image inside iframe GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=5, i",
  "referer": "https://uatracer.com/r/cBpeAjMj/romRqfBW/iframe",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-d6a23fa8784cd5fba3292558faa086fc-5a2bb4bb076873f7-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:28.712 UTC +6208 ms CSS @import (nested stylesheet) GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "text/css,*/*;q=0.1",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=2",
  "referer": "https://uatracer.com/r/cBpeAjMj/romRqfBW/style.css",
  "sec-fetch-dest": "style",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-49866cda1b9e4ac9aaef0f30e1e7c9b0-83d4751c5a5beca8-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:29.940 UTC +7436 ms JS executed beacon GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=5, i",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-6f909d3b430f087e2c8ac69e73100805-0eae61b298a39b09-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:29.950 UTC +7446 ms CSS background-image GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=4, i",
  "referer": "https://uatracer.com/r/cBpeAjMj/romRqfBW/style.css",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-ca9bb27c57af5b2f68ca340c6d4874e7-0ade764dab4ff982-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:29.996 UTC +7492 ms web app manifest GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (16) 
{
  "accept": "*/*",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=4",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "manifest",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-93bb34e93d96753adc1d65ab65828f3a-373fd5370e6b9fbc-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:29.998 UTC +7494 ms CSS @font-face GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (16) 
{
  "accept": "application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8",
  "accept-encoding": "identity",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "referer": "https://uatracer.com/r/cBpeAjMj/romRqfBW/style.css",
  "sec-fetch-dest": "font",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-8058ca4a4aefff926c00de74b1711a56-5d556c05ef9a99f2-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}
2026-07-03 04:30:29.998 UTC +7494 ms ES module executed GET Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0
request headers (17) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US,en;q=0.9",
  "cookie": "ua-tracer-trace=cBpeAjMj",
  "dnt": "1",
  "host": "uatracer.com",
  "priority": "u=5, i",
  "referer": "https://uatracer.com/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "sec-gpc": "1",
  "te": "trailers",
  "traceparent": "00-3a4a18bcc0087b14e6b6dc2d7e992949-c721ba58e432d456-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 10; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0",
  "via": "HTTP/2 ams.vultr.prod.deno-cluster.net"
}

Client-side resource waterfall

JS executed (beacon hit) but no resource-timing payload was posted (UA may block sendBeacon/fetch or strip the body).