Bot management · Akamai
Akamai Bot Manager
Difficulty 5/5
Enterprise-grade, and everywhere in retail and ticketing. The `_abck` cookie is the most studied artefact in this whole category.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: high
How it decides
-
A sensor payload posted back to an `/akam/<version>/` path, encoding device, TLS and interaction data.
-
`_abck` — the bot cookie. Validity is carried in the cookie body: a `~0~` segment means the sensor was accepted, `~-1~` means it was not.
-
`bm_sz`, `ak_bmsc` and `bm_sv` carry session and mitigation state alongside it.
-
Edge rate and reputation rules that run before the origin ever sees the request.
What you see when it stops you
- “Access Denied” with a `Reference #18.xxxxxxxx` code
- `_abck`, `bm_sz`, `ak_bmsc` or `bm_mi` cookies
- `server: AkamaiGHost` or `x-akamai-transformed`
- A 403 whose body is a bare “You don’t have permission to access”
Signatures the detector matches
Publicly observable artefacts Akamai Bot Manager sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Cookie | _abck bot cookie | 75 |
| Cookie | bm_sz session cookie | 65 |
| Cookie | ak_bmsc cookie | 65 |
| Cookie | bm_sv cookie | 55 |
| Cookie | bm_mi mitigation cookie | 55 |
| Header | server: AkamaiGHost | 35 |
| Header | x-akamai-transformed header | 40 |
| Header | akamai-grn request id | 40 |
| Page markup | Akamai sensor script path | 65 |
| Page markup | Akamai “Reference #18” denial page | 70 |
| Page markup | Akamai crypto challenge path | 65 |
| Status | 403 access denied | 10 |
What actually gets through
-
A real browser that actually posts the sensor payload. There is no header-only path through Bot Manager.
-
Residential exits for retail and ticketing deployments, which are usually configured at the strictest tier.
-
Warm the session: load the landing page, let the sensor post, then hit the endpoint you care about.
-
Sticky sessions. Rotating mid-flow invalidates `_abck` and restarts the whole handshake.
Hosts on record running it
From the detector's curated database. Observed, not live — stacks change, and large sites often run different protection per market.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.