Ticketmaster
Ticketing
Combines bot management with waiting rooms, so a 302 into a queue and a 403 block mean completely different things and need opposite responses.
Ticketing is the environment that produced most of the modern anti-automation arms race, and Ticketmaster's edge reflects that. Two very different mechanisms operate side by side: bot management, which refuses traffic, and queueing, which orders it.
Telling them apart is the whole diagnostic task. A 302 into a waiting room is not a block, and the correct response is to follow the redirect and wait. A 403 is a block, and waiting achieves nothing. Getting this backwards produces either an abandoned session that would have been served, or a retry loop that will never succeed.
A plain request to the site returned a 403 with a sparse header set, consistent with an edge refusal ahead of the application.
What is in front of it
- Queue-it: Not a bot blocker at all: a fairness queue that answers with 302 redirects, so its signature is a redirect to a queue-it.net waiting room rather than an error.
- Akamai Bot Manager: Denies with a 403 Access Denied page carrying a reference number, and is unusual in offering operators a deliberately ambiguous 200 response and a tarpit that never answers at all.
- Bot management at the CDN edge.
- Virtual waiting rooms during high-demand onsales, which is where the 302 pattern appears.
Status codes
403 Edge block
Blocked. Observed behaviour.
The request was refused before reaching the application.
What triggers it
- Data centre address ranges.
- Client fingerprints inconsistent with a browser.
- Elevated protection during an onsale.
How to confirm it
- A sparse header set with no application cookies and a minimal body.
What to do about it
- Distinguish this from a queue redirect before reacting. They demand opposite behaviour.
- Do not retry a 403 in a loop during an onsale. It will not clear and it adds to the load that raised protection in the first place.
302 Waiting room redirect
Rate limited. Observed behaviour.
The session was placed in a virtual waiting room because demand exceeds capacity. Not a bot verdict.
What triggers it
- An onsale or high-demand event with queueing enabled.
How to confirm it
- A Location header pointing at a waiting room host, often under queue-it.net.
What to do about it
- Follow the redirect, keep cookies, and wait. This is the intended path and it works.
- Preserve the queue token on the redirect back. Stripping the query string sends you to the back of the line.
Notes
- Automated ticket purchasing is restricted by law in several jurisdictions, including the United States BOTS Act, quite apart from any site's terms.