Incapsula / Imperva

An Incapsula (now Imperva) bypass without a browser. Takion generates the reese84 and ___utmvc cookies that Imperva's wall demands, so your requests get through and stay through.

Check our example bundles in order to validate your implementation against our validate ones, with correct headers order, TLS and flow from our Github repo

What is Incapsula (now Imperva)?

Incapsula is a Web Application Firewall (WAF) that shields websites from attacks like DDoS, bot traffic, and other threats by scrutinizing web traffic and determining whether it is human or automated. It often requires specific cookies, such as reese84 or ___utmvc, to grant access to the website.

Detecting an Incapsula site

Websites protected by Incapsula typically use these cookies to validate user sessions:

reese84: Required on many ticketing websites; generated via a valid encrypted payload.
___utmvc: A cookie that checks browser information and is often seen on sites that use Incapsula.

You can detect Incapsula protection by observing the presence of these cookies in the network requests. If the website serves an interstitial block or requires interaction with these cookies, it is an indicator that the site uses Incapsula for security.

When accessing an Incapsula-protected website, your request may be intercepted by the WAF. The site checks for the presence of the required cookies (reese84, ___utmvc). Without these, you will either be blocked or challenged. For example:

reese84 WAF: Requires both the reese84 cookie and solving a captcha (such as GeeTest) to navigate the site.
___utmvc WAF: A solved GeeTest captcha provides the necessary cookies to continue browsing.

Incapsula Cookies and Challenges

Incapsula uses two cookies to track users and allow access:

reese84 Cookie: This is generated using a valid payload. Without it, many websites will block your session.
___utmvc Cookie: This cookie validates browser-specific information .

If you encounter them on a website, it is protected by Incapsula / Imperva.

Incapsula WAF Challenges

Incapsula recently introduced a new WAF for reese84 websites (which currently get a direct block), with a different type based on the GeeTest captcha. It is present only on some websites, together with either the ___utmvc or reese84 cookie, for example the SmythsToys website.