PopTrace Finds the App Behind Android Pop-Ups

Field notes

The web workflow asks the user to leave the suspicious page visible, connect an Android phone over USB, and inspect both the foreground window and preceding activity. Results may show a browser or app store as the current owner, so the site tells users to compare earlier candidates before taking action. The page says diagnostics are parsed in the browser, with no account required and no device or application records uploaded. A separate Android version is described as planned for harder-to-reproduce incidents.