Analytics vendors a scan can detect
Every analytics and marketing vendor in the current signature set: the loader request, the collection request, and why those two are kept apart.
Published signatures
Version 6 of the signature set. A loader request proves the script was fetched. A collection request proves an event left the page. Control vendors are platform signals, not merchant analytics — without that distinction every store that emits one would look like it had analytics installed.
| Vendor | Loader | Collection | Role |
|---|---|---|---|
| Microsoft Clarity | clarity.ms/tag/ | *.clarity.ms/collect | Merchant tag |
| GA4 | googletagmanager.com/gtag/js, googletagmanager.com/gtm.js | *.google-analytics.com/g/collect, analytics.google.com/g/collect, region*.google-analytics.com/g/collect | Merchant tag |
| Google Ads | googleadservices.com/pagead/conversion | *.google.com/pagead/1p-conversion, googleadservices.com/pagead/conversion/ | Merchant tag |
| Hotjar | static.hotjar.com/c/hotjar- | *.hotjar.io/ | Merchant tag |
| Klaviyo | static.klaviyo.com/onsite/js/klaviyo.js | a.klaviyo.com/onsite/track, a.klaviyo.com/client/ | Merchant tag |
| Meta | connect.facebook.net/*/fbevents.js | *.facebook.com/tr, *.facebook.com/tr | Merchant tag |
| Modovisa | cdn.modovisa.com/modovisa.min.js, cdn.modovisa.com/modovisa.js, modovisa.min.js, modovisa.js | api.modovisa.com/api/collect | Merchant tag |
| s.pinimg.com/ct/core.js, s.pinimg.com/ct/, assets.pinterest.com/js/pinit | ct.pinterest.com/v3/ | Merchant tag | |
| Shopify | cdn.shopify.com/s/trekkie, /cdn/s/trekkie, trekkie.storefront | monorail-edge.shopifysvc.com/, */.well-known/shopify/monorail | Control |
| Snap | sc-static.net/scevent.min.js | tr.snapchat.com/ | Merchant tag |
| TikTok | analytics.tiktok.com/i18n/pixel/events.js | analytics.tiktok.com/api/v2/pixel | Merchant tag |
Reading a signature
A tag can load and still send nothing. That is the failure this product exists to find, so the two columns are recorded separately. A change to either signature is a new set version and a changelog entry — never an edit — or every historical scan silently changes meaning.