> For the complete documentation index, see [llms.txt](https://docs.takionapi.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.takionapi.tech/incapsula.md).
# Incapsula / Imperva
{% hint style="info" %}
Check our example bundles in order to validate your implementation against our validate ones, with correct headers order, TLS and flow from our [**Github repo**](https://takionapi.tech/examples)
{% endhint %}
## **What is Incapsula (now Imperva)?**
Incapsula is a Web Application Firewall (WAF) that shields websites from attacks like DDoS, bot traffic, and other threats by scrutinizing web traffic and determining whether it is human or automated. It often requires specific cookies, such as `reese84` or `___utmvc`, to grant access to the website.
## Detecting an Incapsula site
Websites protected by Incapsula typically use these cookies to validate user sessions:
* **reese84**: Required on many ticketing websites; generated via a valid encrypted payload.
* **\_\_\_utmvc**: A cookie that checks browser information and is often seen on sites that use Incapsula.
You can detect Incapsula protection by observing the presence of these cookies in the network requests. If the website serves an interstitial block or requires interaction with these cookies, it is an indicator that the site uses Incapsula for security.
When accessing an Incapsula-protected website, your request may be intercepted by the WAF. The site checks for the presence of the required cookies (`reese84`, `___utmvc`). Without these, you will either be blocked or challenged. For example:
* **reese84 WAF**: Requires both the `reese84` cookie and solving a captcha (such as GeeTest) to navigate the site.
* **\_\_\_utmvc WAF**: A solved GeeTest captcha provides the necessary cookies to continue browsing.
## **Incapsula Cookies and Challenges**
Incapsula uses two cookies to track users and allow access:
* **reese84 Cookie**: This is generated using a valid payload. Without it, many websites will block your session.
* **\_\_\_utmvc Cookie**: This cookie validates browser-specific information .
If you encounter them on a website, it is protected by Incapsula / Imperva.
### **Incapsula WAF Challenges**
Incapsula recently introduced a new WAF for reese84 websites (which currently get a direct block), with a different type based on the [GeeTest captcha](https://www.geetest.com/). It is present only on some websites, together with either the `___utmvc` or `reese84` cookie, for example the SmythsToys website.
**reese84 WAF**
In the case of a reese84 WAF, the website will require a new valid reese84 cookie and a solved GeeTest captcha.
**\_\_\_utmvc WAF**
Unlike the other challenges, it requires only the GeeTest captcha token and will set some `incap_sh_xxx` cookies.
### Some sites using Incapsula
Many high-traffic and ticketing websites use Incapsula for security. These sites typically rely on `reese84` or `___utmvc` cookies. A few examples:
| Website | reese84 | \_\_\_utmvc | WAF |
| ---------------------------------------------------------------------------- | ------- | ----------- | --- |
| [ticketmaster.com](https://www.ticketmaster.com/) (and other US domains) | ✅ | | |
| [ticketmaster.co.uk](https://www.ticketmaster.co.uk/) (and other EU domains) | ✅ | | ✅\* |
| [tickets.rolandgarros.com](https://tickets.rolandgarros.com/) | | ✅ | |
| [smythstoys.com](https://www.smythstoys.com/) | ✅ | ✅ | ✅ |
| [eticketing.co.uk](https://www.eticketing.co.uk/) | ✅ | | |
\**Only some Ticketmaster EU websites use a reese84 WAF.*