microlinkhq / is-antibot / 32758253303

96%

push

github

fix: stop reading Imperva CDN headers as a block (#60)

`x-iinfo` and `x-cdn: Incapsula` are set on every response Imperva fronts,
served pages included, so any Imperva-protected site was permanently
reported as an unresolved challenge.

Measured on microlink production traffic (2026-08-24 07:10-07:16Z): imperva
accounted for 78.5% of all scrape.do spend, 546 of 907 unresolved hops were
`detection=headers` on a `200`, and replaying the four proxy tiers against a
real capture costs 41 units before the change and 1 after.

Imperva has two failure modes and neither is the fingerprint:

- the JS challenge, served as a 200 with a near-empty body whose
  `_Incapsula_Resource` script carries two comma-separated hashes, where a
  served page carries one plus `&ns=`/`&cb=`
- the hard block, a 403/429/503

So detect the challenge by its script signature, and gate the header and
cookie fingerprints on a blocking status, matching how cloudfront already
handles the same CDN-header problem.

reCAPTCHA had the same shape: `grecaptcha.ready`/`execute` is v3 on an
ordinary form, not a wall. Gate those calls on a blocking status and keep the
200 case that matters -- the v2 widget rendered on the page -- as its own
rule, so a captcha interstitial is still caught.

Fixtures are real captures, both 200 with `x-iinfo`, differing only in the
challenge signature.

160 of 169 branches covered (94.67%)

Branch coverage included in aggregate %.

359 of 372 relevant lines covered (96.51%)

437.49 hits per line