Nike
Retail
Runs Akamai, identifiable by the akamai-grn reference header that appears on allowed and denied responses alike.
Nike's edge carries akamai-grn, Akamai's global request number, on ordinary successful responses. That makes it a clean example of a presence marker rather than a verdict marker: the header is there whether or not anything was blocked.
Product drops make Nike a standing target for automated purchasing, so its protection is tuned for scarce-inventory events rather than only for content scraping, and behaviour on a launch differs from behaviour on a normal day.
What is in front of it
- Akamai Bot Manager: Denies with a 403 Access Denied page carrying a reference number, and is unusual in offering operators a deliberately ambiguous 200 response and a tarpit that never answers at all.
- Akamai at the edge, with a renamed server header reading unified-edge-router rather than AkamaiGHost.
- x-akamai-transformed on responses that passed through Akamai's optimisation pipeline.
Status codes
403 Access Denied
Blocked. Observed behaviour.
Akamai Bot Manager denied the request, with a reference number for support.
What triggers it
- A missing or stale _abck verdict cookie.
- TLS or HTTP/2 fingerprints inconsistent with the claimed browser.
- Elevated protection during a product launch.
How to confirm it
- akamai-grn on the response.
- A body containing Access Denied and a Reference # value.
What to do about it
- Capture both the reference number and akamai-grn before doing anything else.
- Note that the renamed server header means server: AkamaiGHost is absent. Attribution has to come from akamai-grn instead.
Notes
- Operators routinely rename the Server header, so its absence is not evidence that Akamai is not present. akamai-grn is the durable marker.