Zillow

Real estate

Blocks with a 403 carrying an explicit x-px-blocked header, which is about as unambiguous as attribution gets.

Zillow returns a 403 with x-px-blocked: 1, the HUMAN Security block marker, served through CloudFront. There is no guesswork involved: the header names the product that made the decision.

The response also carries x-cache: LambdaGeneratedResponse from cloudfront, which shows the block is generated at the CDN edge rather than by the application. The request never reaches Zillow's own servers.

Property listing data attracts persistent automated collection, and the site's protection is correspondingly firm and applied to ordinary listing pages rather than only to sensitive endpoints.

What is in front of it

HUMAN Security: The former PerimeterX. Blocks with a 403 that often carries an explicit x-px-blocked header, and answers blocked AJAX calls with JSON instead of an HTML challenge page.
HUMAN Security, formerly PerimeterX, enforcing at the edge.
AWS CloudFront as the CDN, with the block generated by an edge function.

Status codes

403 PerimeterX block

Blocked. Observed behaviour.

The HUMAN enforcer scored the request above the blocking threshold and refused it at the edge.

What triggers it

No valid _px3 cookie, which requires the client-side sensor to have run.
Data centre address ranges.
A fingerprint inconsistent with the browser the request claims to be.

How to confirm it

x-px-blocked: 1 on the response.
server: CloudFront with x-cache: LambdaGeneratedResponse from cloudfront.

What to do about it

Read the HUMAN entry in this glossary. The block is a scoring decision, and the short cookie lifetime and sensor requirement explain most of the behaviour.
Do not retry. The score will not change because you asked again.

HTTP/2 403
server: CloudFront
x-px-blocked: 1
x-cache: LambdaGeneratedResponse from cloudfront

Notes

x-px-blocked is one of the few headers that states the verdict outright rather than merely identifying the vendor.