ua-tracer by Paul Kinlan

ua-tracer

what does a user agent actually fetch, follow & run?

← all traces

Trace bbf2b7AN

First seen: 2026-06-22 12:28:33.168 UTC
User-Agent: Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0

What this user agent did

Directly-referenced assets:

✓ fetched CSS ✓ fetched JS ✓ fetched image ✓ fetched font (HTML)

Document-level link hints:

✗ fetched favicon ✓ fetched apple-touch-icon ✓ fetched web manifest ✓ fetched preload ✗ fetched prefetch

Second-level follows (proves it parsed the linking file):

✓ followed CSS background-image ✓ followed CSS @font-face ✗ followed manifest icon ✗ followed CSS @import

Frames (does it descend into iframes?):

✗ fetched iframe document ✗ descended into iframe (loaded inner image)

Reporting (a report-only CSP is violated by inline styles; reports can arrive via HTTP headers with no JS, or via in-page beacons):

✗ sent a CSP/Reporting report (any path) ✗ delivered via report-uri/Report-To header (no JS) ✗ delivered via in-page beacon (securitypolicyviolation / ReportingObserver)

Social embed (Open Graph / Twitter card images):

✗ fetched og:image ✗ fetched twitter:image

JavaScript execution:

✓ EXECUTED classic JS ✓ EXECUTED ES module ✗ posted client timing

Server-side request waterfall

Every request the server received for this trace, in receive order. +ms is the delta from the homepage request.

ReceivedΔKindMethodUser-Agent
2026-06-22 12:28:33.168 UTC +0 ms homepage GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (16) 
{
  "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=0, i",
  "referer": "https://pinboard.in/",
  "sec-fetch-dest": "document",
  "sec-fetch-mode": "navigate",
  "sec-fetch-site": "cross-site",
  "sec-fetch-user": "?1",
  "te": "trailers",
  "traceparent": "00-d456ea7f8f6f25e7e738b08f93737e02-7eae0556f027a9fc-01",
  "tracestate": "",
  "upgrade-insecure-requests": "1",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:33.898 UTC +730 ms CSS GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "text/css,*/*;q=0.1",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=2",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "style",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-d0ef97bea3f095e239f8ebe0fad1e2db-9d2a30baa0282414-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:33.900 UTC +732 ms JS GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (13) 
{
  "accept": "*/*",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "script",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-16c13271aba9d2c1604e66f5620e1546-4bf77991047ce929-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:33.901 UTC +733 ms font (HTML) GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=2",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "font",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-bf2372461f1d0efffc3194957b662057-77a7e024e6a34ba3-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:33.910 UTC +742 ms preload (image) GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=5, i",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-7e4f95ebcc7b977371e077f55099ba13-a7e5e58e45f45e93-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:33.912 UTC +744 ms ES module GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (13) 
{
  "accept": "*/*",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "script",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-b0041de67105fa8758cd92b1ed7d842f-1089dd81737cf1fb-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:33.912 UTC +744 ms image GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=5, i",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-2740d222efb82d9c56eebc6258530536-c86481a427f4b74a-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:34.373 UTC +1205 ms CSS background-image GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=4, i",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/r/bbf2b7AN/style.css",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-18931c07b5233a1f2fd3e19a1f0476e4-c87395e2d1b0f05d-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:34.434 UTC +1266 ms CSS @font-face GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (13) 
{
  "accept": "application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8",
  "accept-encoding": "identity",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/r/bbf2b7AN/style.css",
  "sec-fetch-dest": "font",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-d092d1e30ca51432bd1c33327e632fb5-fb128bd4364d5eab-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:34.566 UTC +1398 ms JS executed beacon GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=5, i",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-43f3dd326af0c63bf1badbff69da336d-ee68ed94f3b2b6e8-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:35.245 UTC +2077 ms ES module executed GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=5, i",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "image",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-c355a5afd3ca223abf8d187f5dc367e5-02c5e5d4f94539a3-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:35.261 UTC +2093 ms web app manifest GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (14) 
{
  "accept": "*/*",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=4",
  "referer": "https://ua-tracer.paulkinlan-ea.deno.net/",
  "sec-fetch-dest": "manifest",
  "sec-fetch-mode": "cors",
  "sec-fetch-site": "same-origin",
  "te": "trailers",
  "traceparent": "00-11a0df7dbcaf20bacbbb6342cf647b6b-cba0ca00a62d8487-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}
2026-06-22 12:28:35.447 UTC +2279 ms apple-touch-icon GET Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0
request headers (13) 
{
  "accept": "*/*",
  "accept-encoding": "gzip, deflate, br, zstd",
  "accept-language": "en-US",
  "host": "ua-tracer.paulkinlan-ea.deno.net",
  "priority": "u=4",
  "sec-fetch-dest": "empty",
  "sec-fetch-mode": "no-cors",
  "sec-fetch-site": "none",
  "te": "trailers",
  "traceparent": "00-2281de642c8044bc6f8d32cbf3c04c17-2be93ee16c9f6db3-01",
  "tracestate": "",
  "user-agent": "Mozilla/5.0 (Android 16; Mobile; rv:152.0) Gecko/152.0 Firefox/152.0",
  "via": "HTTP/2 ord.vultr.prod.deno-cluster.net"
}

Client-side resource waterfall

JS executed (beacon hit) but no resource-timing payload was posted (UA may block sendBeacon/fetch or strip the body).