___utmvc Bypass Solution

The ___utmvc cookie is the second path through an Incapsula bypass. Find the _Incapsula_Resource script, send its content to Takion, and we return the ___utmvc cookie to set on your session.

How the solution works

To bypass Incapsula's (Imperva's) protection, follow these steps:

1. Find the ___utmvc script URL.

2. Load the script content.

3. Generate the cookie based on it (using our API).

How to identify the script URL

After visiting the target website, you can easily search for the following regex inside the HTML content. It will find and extract the needed URL.

src="(/_Incapsula_Resource?[^"]+)"

Endpoint

The endpoint lives on the Castle subdomain:

https://incapsula.takionapi.tech/utmvc

Generate the ___utmvc cookie

post

Send the _Incapsula_Resource script content plus your current session cookies and get back the ___utmvc cookie to set before retrying the original request.

Authorizations

ApiKeyHeaderApiKeyQuery

x-api-keystringRequired

Body

application/json

contentstringRequired

The response text of the _Incapsula_Resource challenge script fetched from the target site.

Other propertiesanyOptional

Responses

200

The ___utmvc cookie. On a bad request an error field is returned instead — check for error first.

application/json

or

401

Authentication or quota failure — HTTP 401 with an error message.

application/json

500

Unexpected server error (HTTP 500).

application/json

post/utmvc

HTTPcURLJavaScriptPython

POST /utmvc HTTP/1.1
Host: incapsula.takionapi.tech
x-api-key: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 131

{
  "content": "text",
  "cookies": [
    [
      "visid_incap_123456",
      "aBc…"
    ],
    [
      "incap_ses_1_123456",
      "xYz…"
    ]
  ],
  "ANY_ADDITIONAL_PROPERTY": "anything"
}

{
  "___utmvc": "text",
  "ANY_ADDITIONAL_PROPERTY": "anything"
}