Identify the protection on a site

Every protection vendor leaves fingerprints in the traffic: the cookies it sets, the scripts it loads, and the shape of its block page. Record one visit with powhttp, then read the three places below.

Look at the cookies

Open the first response from the site’s own host and read its set-cookie headers.

Cookie names	What it means
`_abck`, `bm_sz`, and often `bm_sv`, `bm_mi`	Akamai Bot Manager. The `_abck` value is long and contains `~-1~` on a fresh session; a browser that passed the sensor check has `~0~` there instead.
`sbsd_o`, `bm_so`, `bm_o`, `bm_sc` alongside the above	Akamai with SBSD switched on. See SBSD.
`sec_cpt` alongside the above	Akamai with Sec-CPT switched on. See Sec-CPT.
`datadome`	DataDome. Not Akamai; Roolink does not cover it.
`cf_clearance`, `__cf_bm`	Cloudflare. Not Akamai; Roolink does not cover it.
`_px2`, `_px3`, `_pxvid`	HUMAN (PerimeterX). Not Akamai; Roolink does not cover it.

In a mobile app the same Akamai cookies appear on the app’s API host, and protected requests carry an extra header, X-acf-sensor-data, with a long opaque value. That header is the mark of Akamai BMP, the SDK version of Bot Manager.

Look for the script

Akamai Bot Manager loads one script from the site’s own host. Its path looks random, has no file extension, and is usually the last <script> before </body>:

<script type="text/javascript" src="/aB3dE/fG7/hI/jK/LmNoPqRsTuVwXyZ" defer></script>

The browser posts to that same path a moment later with a sensor_data body. If you see the pair, the site runs Akamai Web, and the Quickstart is your next stop. Two smaller scripts tell you which extras are on:

Script	Extra
A second script on the site’s host whose query string carries `v=<UUID>`	SBSD. A `t=` parameter next to the `v=` means the site is actively challenging you: SBSD challenge (429).
A script whose response mentions `bazadebezolkohpepadr`	Pixel. Present on many sites, enforced on very few. See Pixel.

Look at the first blocked response

When a request is refused, the response itself names the vendor.

Response	What it means
`403` with an “Access Denied” page and a line such as `Reference #18.6f2c1a7b.1700000000.abc123`	Akamai. The reference number is the giveaway.
`429` whose body contains the SBSD script tag with `v=` and `t=` in its query, or a small JSON body with a `t` token	Akamai SBSD challenge: SBSD challenge (429).
`428` with a JSON body containing `sec-cp-challenge`, `token`, `nonce` and `difficulty`	Akamai Sec-CPT: Sec-CPT.
A protected action returns an error page or empty result while `_abck` still contains `~-1~`	Akamai, and the sensor was never accepted. Work through the Quickstart.
A page titled “Please verify you are a human” with a `datadome` cookie	DataDome. Not covered.
”Checking your browser” or “Just a moment…”	Cloudflare. Not covered.

Pick the product

You are automating	Signs	Product
A website in a browser	`_abck` and `bm_sz` cookies, the random-path script, `sensor_data` posts	Akamai Web
A mobile app’s API	`X-acf-sensor-data` header on protected requests, Akamai cookies on the API host	Akamai BMP
Anything else	None of the above	Roolink does not cover it today. Ask in Discord if you are unsure what you are looking at.

A site can run more than one layer. Solve the sensor first, then add SBSD, Sec-CPT or Pixel only when the recording shows the site uses them.

Get started

Products

Identify the protection on a site

Look at the cookies

Look for the script

Look at the first blocked response

Pick the product

​Look at the cookies

​Look for the script

​Look at the first blocked response

​Pick the product

Look at the cookies

Look for the script

Look at the first blocked response

Pick the product