Imperva Incapsula X-Iinfo and Incident ID Patterns

Signal observed → what it means for your scraper

Match the signal you captured, then decide whether a residential proxy can change that layer before you rotate.

Signal observed	What it indicates	Which layer	Does a proxy change it
X-Iinfo present	Dash-separated integers plus a short state token (may include digits)	Imperva edge timing/info header	Treat as strong corroboration. Do not parse fields into fake semantics.
visid_incap_* + incap_ses_*	Persistent visid + session incap cookies; nlbi_* may accompany	Incapsula-lineage Cloud WAF cookie family	Attribute Imperva/Incapsula. Match trailing site id across visid/incap_ses when present.
Incapsula incident ID …	Iframe fallback or modern Error 15-style page with incident id + Proxy IP	Cloud WAF block template	Copy the full ID to the site owner. IDs starting with 0- may be session-less / unlookupable per Imperva guidance.
X-CDN: Imperva	CDN header value literally Imperva	Imperva delivery in path	Corroborate with cookies or incident text; bare X-CDN without value Imperva is meaningless.
Pardon Our Interruption only	Generic interstitial, no incap_*/X-Iinfo	Ambiguous — not vendor-exclusive	Do not call Imperva yet. Run three-way curl; look for positive markers or edge IP in Imperva ranges.
reese84 / utmvc cookies alone	Tooling blogs claim Distil ABP	Unverified Distil-lineage cookie claims	Seek incap_*/X-Iinfo before remediation; do not decode underscore counts as fact.

How to diagnose and fix this scraper failure

1
Collect positive markers first
Save X-Iinfo, X-CDN, Set-Cookie names (visid_incap_, incap_ses_, nlbi_), body hits for Incapsula incident ID and /_Incapsula_Resource. Optional: confirm Proxy IP via whois (Incapsula Inc / THALES-IMPERVA) or Imperva’s public IP-range API.
Field note: X-Iinfo state tokens can include digits — do not publish N/Y-only alphabets.
2
Handle incident IDs as opaque patterns
Copy the full string after “Incapsula incident ID” or “Incident ID:”. Segment lengths vary across fetches — never assert a fixed digit recipe. If the ID starts with 0-, expect limited console traceability per Imperva’s own session-less guidance.
Python
```
import re

INCIDENT = re.compile(
    r"(?:Incapsula\s+incident\s+ID|Incident\s+ID)\s*:?\s*([0-9]+-[0-9]+)",
    re.I,
)

def incident_id(html: str) -> str | None:
    m = INCIDENT.search(html or "")
    return m.group(1) if m else None  # opaque; do not decode segments
```

Three-way curl on the failing URL

Plain vs Chrome-UA vs residential. Keep X-Iinfo and cookie names per leg. Soft 200 interstitials still count as blocks — assert titles/body text.

bash

URL=https://TARGET/
UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36'
PX=http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499
probe() { echo "($1)"; curl -sS -D - -o /tmp/imp.body "${@:2}" | grep -iE 'HTTP/|x-iinfo|x-cdn|set-cookie: (visid_incap|incap_ses|nlbi)'; grep -iE 'incident id|incapsula_resource|pardon our interruption' /tmp/imp.body | head; }
probe plain "$URL"
probe ua "$URL" -A "$UA"
probe res "$URL" -A "$UA" -x "$PX"

4
Separate Distil-lineage cookie names from Incapsula facts
If blogs mention reese84 or utmvc-style cookies, treat them as Distil-lineage claims unless you also see incap_*/X-Iinfo. Continue the incident using verified Incapsula markers. Do not treat underscore counts as diagnostic facts.
5
Remediate by layer
IP/geo flip on residential → keep Elite exits. Identical Imperva envelopes everywhere → browser-capable client for cookie/JS challenges. Open a ticket with the site owner using the opaque incident ID when you legitimately need an allowlist discussion.

What goes wrong when this scraper fails

Incident tickets say “Imperva blocked us” when the only evidence is a vague interstitial, or teams invent digit formats for incident IDs that break on the next fetch. Others chase Distil cookie names from bypass blogs while ignoring X-Iinfo sitting in the response. This guide forces positive identification and pattern-level incident handling.

When residential proxies fix this — and when they cannot

Residential exits change Imperva’s IP/ASN and velocity inputs. They do not satisfy cookie/JS challenges or rewrite TLS fingerprints. If incap_* cookies and X-Iinfo persist with the same block body on every clean exit, the lever is the client, not more GB.

How Aethyn residential proxies help here

Confirm the blocking edge (whois / Imperva public IP ranges) then A/B Elite residential. Sticky sessions help only after cookies can be held by a real browser context.

Elite HTTP 5499 for Bot Protection–class tenants
Country targeting for geo rules
Premium 2099 for cheap marker surveys
SOCKS5 options for browser tools
No claim that residential defeats Imperva JS challenges alone

Best practices that keep scrapers reliable

Positive markers only for vendor attribution
Opaque incident IDs — pattern, not numerology
Corroborate ambiguous interstitials
Re-check live; Imperva soft blocks are nondeterministic
Public-data / ToS scope — no CAPTCHA solve steps

Common mistakes that burn proxy budget

Fixed digit-length incident parsers
Pardon Our Interruption ⇒ Imperva
Trusting reese84 alone
Over-decoding incap_ses_ fields
Status-only branching

Common questions about this scraper problem

How do I know Imperva/Incapsula blocked my scraper?

Prefer positive signals: visid_incap_/incap_ses_ cookies, X-Iinfo, X-CDN: Imperva, /_Incapsula_Resource, or Incapsula incident ID text. Do not rely on status code alone.

What format is an Incapsula incident ID?

A two-part digit string separated by a hyphen. Lengths vary — store and share the literal value; do not assume fixed widths.

Are reese84 or ___utmvc proof of Imperva?

Not by themselves. They appear in Distil-lineage tooling discussions. Require incap_*/X-Iinfo (or equivalent) before attribution.

Does “Pardon Our Interruption” mean Imperva?

No. That phrase is ambiguous across vendors. Demand a corroborating Imperva marker.

Will residential proxies fix Imperva blocks?

They help IP/ASN/velocity layers. Cookie and JS challenges still need a capable client.

Aethyn ports?

Premium HTTP 2099 / SOCKS5 1099; Elite HTTP 5499 / SOCKS5 3499 on proxy.aethyn.io.

CAPTCHA solving?

Out of scope. Diagnose lawful public-data failures only.

Signal observed → what it means for your scraper

Match the signal you captured, then decide whether a residential proxy can change that layer before you rotate.

Signal observed	What it indicates	Which layer	Does a proxy change it
X-Iinfo present	Dash-separated integers plus a short state token (may include digits)	Imperva edge timing/info header	Treat as strong corroboration. Do not parse fields into fake semantics.
visid_incap_* + incap_ses_*	Persistent visid + session incap cookies; nlbi_* may accompany	Incapsula-lineage Cloud WAF cookie family	Attribute Imperva/Incapsula. Match trailing site id across visid/incap_ses when present.
Incapsula incident ID …	Iframe fallback or modern Error 15-style page with incident id + Proxy IP	Cloud WAF block template	Copy the full ID to the site owner. IDs starting with 0- may be session-less / unlookupable per Imperva guidance.
X-CDN: Imperva	CDN header value literally Imperva	Imperva delivery in path	Corroborate with cookies or incident text; bare X-CDN without value Imperva is meaningless.
Pardon Our Interruption only	Generic interstitial, no incap_*/X-Iinfo	Ambiguous — not vendor-exclusive	Do not call Imperva yet. Run three-way curl; look for positive markers or edge IP in Imperva ranges.
reese84 / utmvc cookies alone	Tooling blogs claim Distil ABP	Unverified Distil-lineage cookie claims	Seek incap_*/X-Iinfo before remediation; do not decode underscore counts as fact.

How to diagnose and fix this scraper failure

1
Collect positive markers first
Save X-Iinfo, X-CDN, Set-Cookie names (visid_incap_, incap_ses_, nlbi_), body hits for Incapsula incident ID and /_Incapsula_Resource. Optional: confirm Proxy IP via whois (Incapsula Inc / THALES-IMPERVA) or Imperva’s public IP-range API.
Field note: X-Iinfo state tokens can include digits — do not publish N/Y-only alphabets.
2
Handle incident IDs as opaque patterns
Copy the full string after “Incapsula incident ID” or “Incident ID:”. Segment lengths vary across fetches — never assert a fixed digit recipe. If the ID starts with 0-, expect limited console traceability per Imperva’s own session-less guidance.
Python
```
import re

INCIDENT = re.compile(
    r"(?:Incapsula\s+incident\s+ID|Incident\s+ID)\s*:?\s*([0-9]+-[0-9]+)",
    re.I,
)

def incident_id(html: str) -> str | None:
    m = INCIDENT.search(html or "")
    return m.group(1) if m else None  # opaque; do not decode segments
```

Three-way curl on the failing URL

Plain vs Chrome-UA vs residential. Keep X-Iinfo and cookie names per leg. Soft 200 interstitials still count as blocks — assert titles/body text.

bash

URL=https://TARGET/
UA='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36'
PX=http://aethyn-XXXXX-country-us:PASSWORD@proxy.aethyn.io:5499
probe() { echo "($1)"; curl -sS -D - -o /tmp/imp.body "${@:2}" | grep -iE 'HTTP/|x-iinfo|x-cdn|set-cookie: (visid_incap|incap_ses|nlbi)'; grep -iE 'incident id|incapsula_resource|pardon our interruption' /tmp/imp.body | head; }
probe plain "$URL"
probe ua "$URL" -A "$UA"
probe res "$URL" -A "$UA" -x "$PX"

4
Separate Distil-lineage cookie names from Incapsula facts
If blogs mention reese84 or utmvc-style cookies, treat them as Distil-lineage claims unless you also see incap_*/X-Iinfo. Continue the incident using verified Incapsula markers. Do not treat underscore counts as diagnostic facts.
5
Remediate by layer
IP/geo flip on residential → keep Elite exits. Identical Imperva envelopes everywhere → browser-capable client for cookie/JS challenges. Open a ticket with the site owner using the opaque incident ID when you legitimately need an allowlist discussion.

What goes wrong when this scraper fails

When residential proxies fix this — and when they cannot

How Aethyn residential proxies help here

Confirm the blocking edge (whois / Imperva public IP ranges) then A/B Elite residential. Sticky sessions help only after cookies can be held by a real browser context.

Elite HTTP 5499 for Bot Protection–class tenants
Country targeting for geo rules
Premium 2099 for cheap marker surveys
SOCKS5 options for browser tools
No claim that residential defeats Imperva JS challenges alone

Best practices that keep scrapers reliable

Positive markers only for vendor attribution
Opaque incident IDs — pattern, not numerology
Corroborate ambiguous interstitials
Re-check live; Imperva soft blocks are nondeterministic
Public-data / ToS scope — no CAPTCHA solve steps

Common mistakes that burn proxy budget

Fixed digit-length incident parsers
Pardon Our Interruption ⇒ Imperva
Trusting reese84 alone
Over-decoding incap_ses_ fields
Status-only branching

Common questions about this scraper problem

How do I know Imperva/Incapsula blocked my scraper?

Prefer positive signals: visid_incap_/incap_ses_ cookies, X-Iinfo, X-CDN: Imperva, /_Incapsula_Resource, or Incapsula incident ID text. Do not rely on status code alone.

What format is an Incapsula incident ID?

A two-part digit string separated by a hyphen. Lengths vary — store and share the literal value; do not assume fixed widths.

Are reese84 or ___utmvc proof of Imperva?

Not by themselves. They appear in Distil-lineage tooling discussions. Require incap_*/X-Iinfo (or equivalent) before attribution.

Does “Pardon Our Interruption” mean Imperva?

No. That phrase is ambiguous across vendors. Demand a corroborating Imperva marker.

Will residential proxies fix Imperva blocks?

They help IP/ASN/velocity layers. Cookie and JS challenges still need a capable client.

Aethyn ports?

Premium HTTP 2099 / SOCKS5 1099; Elite HTTP 5499 / SOCKS5 3499 on proxy.aethyn.io.

CAPTCHA solving?

Out of scope. Diagnose lawful public-data failures only.

Imperva / Incapsula: Which Engine Blocked You?

Key takeaways

On this page

Signal observed → what it means for your scraper

How to diagnose and fix this scraper failure

Collect positive markers first

Handle incident IDs as opaque patterns

Three-way curl on the failing URL

Separate Distil-lineage cookie names from Incapsula facts

Remediate by layer

What goes wrong when this scraper fails

When residential proxies fix this — and when they cannot

How Aethyn residential proxies help here

Best practices that keep scrapers reliable

Common mistakes that burn proxy budget

Common questions about this scraper problem

References

Solve this with Aethyn residential proxies

Imperva / Incapsula: Which Engine Blocked You?

Key takeaways

On this page

Signal observed → what it means for your scraper

How to diagnose and fix this scraper failure

Collect positive markers first

Handle incident IDs as opaque patterns

Three-way curl on the failing URL

Separate Distil-lineage cookie names from Incapsula facts

Remediate by layer

What goes wrong when this scraper fails

When residential proxies fix this — and when they cannot

How Aethyn residential proxies help here

Best practices that keep scrapers reliable

Common mistakes that burn proxy budget

Common questions about this scraper problem

References

Solve this with Aethyn residential proxies

Key takeaways

On this page

Signal observed → what it means for your scraper

How to diagnose and fix this scraper failure

Collect positive markers first

Handle incident IDs as opaque patterns

Three-way curl on the failing URL

Separate Distil-lineage cookie names from Incapsula facts

Remediate by layer

What goes wrong when this scraper fails

When residential proxies fix this — and when they cannot

How Aethyn residential proxies help here

Best practices that keep scrapers reliable

Common mistakes that burn proxy budget

Common questions about this scraper problem

Related guides & resources

References

Solve this with Aethyn residential proxies

Key takeaways

On this page

Signal observed → what it means for your scraper

How to diagnose and fix this scraper failure

Collect positive markers first

Handle incident IDs as opaque patterns

Three-way curl on the failing URL

Separate Distil-lineage cookie names from Incapsula facts

Remediate by layer

What goes wrong when this scraper fails

When residential proxies fix this — and when they cannot

How Aethyn residential proxies help here

Best practices that keep scrapers reliable

Common mistakes that burn proxy budget

Common questions about this scraper problem

Related guides & resources

References

Solve this with Aethyn residential proxies