F5 Shape: The Fingerprint Is in the Request

Which defense layers are scoring your request

How to implement this with residential proxies

1. 1

   Map asymmetry before naming the vendor

   Hit the document URL and the failing XHR/POST with the same client. Shape-class deployments often protect methods differently — a 200 homepage never falsifies Bot Defense on /api/availability.

2. 2

   Eliminate lookalike cookies

   TS + hex → BIG-IP ASM (length varied by version). BIGipServer* → LTM persistence. MRHSession/F5_ST family → APM. reese84 → Imperva Distil-lineage cookie name, not Shape. x-acf-sensor-data → Akamai mobile sensor. None of these equal Bot Defense.

3. 3

   Three-way curl on the failing method

   Plain, Chrome-UA, residential — against the protected endpoint, not only /. Expect missing telemetry to look similar across exits when Transform/Block ignores IP.

   bashCopy

   EP='https://TARGET/api/availability'
   UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36'
   PX='http://aethyn-XXXXX-country-us-isp-comcast:PASSWORD@proxy.aethyn.io:5499'
   for label in plain ua res; do
     echo "=== $label ==="
     case $label in
       plain) curl -sS -D - -o /tmp/sh.body "$EP" ;;
       ua) curl -sS -D - -o /tmp/sh.body "$EP" -A "$UA" ;;
       res) curl -sS -D - -o /tmp/sh.body "$EP" -A "$UA" -x "$PX" ;;
     esac | grep -iE 'HTTP/|set-cookie:|content-type|x-volterra-location'
     python - <<'PY'
   from pathlib import Path
   b=Path('/tmp/sh.body').read_bytes()
   print('bytes', len(b), 'head', b[:120])
   PY
   done

4. 4

   Read F5-documented behaviours, not unverified blog claims

   Prefer primary facts: telemetry in headers or POST body; Telemetry Header Prefix as a console field; interstitial on GET(Document) transparent to users and typically once per session; ISTL as an F5 scraping-endpoint configuration name without a confirmed expansion. Avoid publishing single-capture body strings as universal fingerprints.

5. 5

   Remediate honestly

   If residential changes the failing endpoint, keep ISP targeting. If not, you need an instrumented browser path that can attach telemetry under your compliance rules — still not a CAPTCHA-solving guide.

What goes wrong when this scraper fails

Retail collectors scrape the PDP fine, then availability or add-to-cart calls return opaque JS or empty data with 200. Wappalyzer shows Cloudflare or BigIP and the team chases the wrong product. Shape-class failures are silent in response space and loud in endpoint asymmetry.

Why this failure mode happens

F5 documents that Bot Defense collects browser telemetry and attaches it on protected requests, often after an interstitial on GET(Document). Continue/flag mode can let traffic pass while logging — collectors look healthy until mitigation flips. Because telemetry is client-generated, curl without the JS path never participates correctly, and rotating IPs cannot mint tokens.

How Aethyn residential proxies help here

Use ISP-targeted Elite sticky sessions when retail bots are scored per carrier, and keep three-way proof that IP is actually implicated before scaling concurrency.

• Elite HTTP 5499 + ISP suffixes for carrier-sensitive retail
• Sticky lifetimes for session-carrying browser flows
• Premium 2099 for asymmetry surveys
• SOCKS5 3499 for Playwright
• Explicit non-claim: proxy ≠ Shape telemetry

Common questions about this scraper problem

Best practices that keep scrapers reliable

• Test the failing method, not the marketing homepage
• Disqualify BIG-IP/Imperva/Akamai lookalikes
• Prefer F5 primary docs over detector regex blogs
• Assume Continue/flag can precede hard mitigation
• Public-data collection only

Common mistakes that burn proxy budget

• TS* ⇒ Shape
• reese84 ⇒ Shape
• Homepage-only probes
• Infinite IP rotation on transform 200s
• Inventing global telemetry header names