Skip to content

Nike

Retail

Runs Akamai, identifiable by the akamai-grn reference header that appears on allowed and denied responses alike.

Nike's edge carries akamai-grn, Akamai's global request number, on ordinary successful responses. That makes it a clean example of a presence marker rather than a verdict marker: the header is there whether or not anything was blocked.

Product drops make Nike a standing target for automated purchasing, so its protection is tuned for scarce-inventory events rather than only for content scraping, and behaviour on a launch differs from behaviour on a normal day.

What is in front of it

  • Akamai Bot Manager: Denies with a 403 Access Denied page carrying a reference number, and is unusual in offering operators a deliberately ambiguous 200 response and a tarpit that never answers at all.
  • Akamai at the edge, with a renamed server header reading unified-edge-router rather than AkamaiGHost.
  • x-akamai-transformed on responses that passed through Akamai's optimisation pipeline.

Status codes

403 Access Denied

Blocked. Observed behaviour.

Akamai Bot Manager denied the request, with a reference number for support.

What triggers it

  • A missing or stale _abck verdict cookie.
  • TLS or HTTP/2 fingerprints inconsistent with the claimed browser.
  • Elevated protection during a product launch.

How to confirm it

  • akamai-grn on the response.
  • A body containing Access Denied and a Reference # value.

What to do about it

  • Capture both the reference number and akamai-grn before doing anything else.
  • Note that the renamed server header means server: AkamaiGHost is absent. Attribution has to come from akamai-grn instead.

Notes

  • Operators routinely rename the Server header, so its absence is not evidence that Akamai is not present. akamai-grn is the durable marker.

See also