[Blog](https://scrapfly.io/blog) / [blocking](https://scrapfly.io/blog/tag/blocking) / [How to Bypass F5 when Web Scraping in 2026](https://scrapfly.io/blog/posts/how-to-bypass-f5-when-web-scraping) # How to Bypass F5 when Web Scraping in 2026 by [Mayada Shaaban](https://scrapfly.io/blog/author/mayada-shaaban-90143e67) Sep 17, 2026 10 min read [\#blocking](https://scrapfly.io/blog/tag/blocking) [\#headless-browser](https://scrapfly.io/blog/tag/headless-browser) [\#python](https://scrapfly.io/blog/tag/python) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping "Share on LinkedIn") [ ](https://x.com/intent/tweet?url=https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping&text=How%20to%20Bypass%20F5%20when%20Web%20Scraping%20in%202026 "Share on X") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping "Share on Facebook") Summarize this article with [ ](https://chat.openai.com/?q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping) [ ](https://claude.ai/new?q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping) [ ](https://x.com/i/grok?text=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping) [ ](https://www.perplexity.ai/search/new?q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping) [ ](https://www.google.com/search?udm=50&aep=11&q=Summarize%20this%20article%20and%20explain%20how%20Scrapfly%20helps%20me%20scrape%20any%20website%20at%20scale%20and%20bypass%20anti-bot%20systems%20for%20my%20use%20case%3A%20https%3A%2F%2Fscrapfly.io%2Fblog%2Fposts%2Fhow-to-bypass-f5-when-web-scraping) **Web Scraping API**Scrape any website with anti-bot bypass, proxy rotation, and JS rendering. [ Learn More ](https://scrapfly.io/products/web-scraping-api) [ Docs ](https://scrapfly.io/docs/scrape-api/getting-started) You can scrape most pages with an HTTP client until a protected login or checkout flow requires F5's browser telemetry. BIG-IP deployments can expose `TS*` or `TSPD_101*` cookies; Distributed Cloud Bot Defense can disguise its JavaScript path. A plain client may still receive HTTP 200, so verify the expected content rather than relying on status alone. This article covers two distinct F5 deployments: BIG-IP ASM/Advanced WAF Bot Defense and F5 Distributed Cloud Bot Defense, which evolved from Shape Security. You will identify the deployment, inspect its telemetry flow, and configure a browser-backed fetch. [How to Bypass Anti-Bot Protection When Web ScrapingLearn how anti-bot systems detect scrapers and 5 universal bypass techniques including proxy rotation, fingerprinting, and fortified headless browsers.](https://scrapfly.io/blog/posts/how-to-bypass-anti-bot-protection-when-web-scraping) ## Key Takeaways F5 exposes two distinct bot-defense paths: BIG-IP ASM/Advanced WAF Bot Defense at the application edge, and F5 Distributed Cloud Bot Defense, which evolved from Shape Security. - **Use the right signature:** `TS*` indicates BIG-IP ASM; `TSPD_101*` is a BIG-IP Bot Defense cookie. `f5_cspm` comes from AVR, and `reese84` belongs to Imperva. - **Shape uses VM-based JavaScript obfuscation:** F5 says the VM randomizes opcodes frequently and attaches environmental and behavioral telemetry to protected requests. - **Do not infer a block from HTTP 200:** verify that the response contains the expected protected data or an F5 challenge/interstitial. - **Plain HTTP clients cannot produce browser telemetry:** use a browser on endpoints that require the injected JavaScript. - **IP and browser consistency both matter:** F5 evaluates IP/ASN, user-agent, browser, header, device, and behavior signals; residential IPs are not a universal requirement. - **Scrapfly ASP selects the bypass resources:** `asp=True` lets Scrapfly choose the required network and browser path; add `render_js=True` when you explicitly need rendered DOM content. **Get web scraping tips in your inbox**Trusted by 100K+ developers and 30K+ enterprises. Unsubscribe anytime. ## What is F5 Bot Defense? F5 bot defense is F5's family of anti-bot protections. For scrapers it shows up as two distinct products. The first is F5 BIG-IP ASM, the older web application firewall with web-scraping protection. The second is F5 Distributed Cloud Bot Defense, the cloud service built on Shape Security, which F5 acquired for about $1 billion in 2020. Both score whether a visitor is human, but they sit in different places and leave different fingerprints. BIG-IP ASM runs on the edge appliance in front of an origin. Distributed Cloud Bot Defense runs Shape's JavaScript engine in the browser and decides in the cloud. Its injected JavaScript collects environmental and behavioral telemetry before protected requests reach the application. ## How to Identify an F5 / Shape Block Start with deployment-specific signals. `TS*` cookies identify BIG-IP ASM, while `TSPD_101*` is associated with BIG-IP Bot Defense. Do not use `f5_cspm` as a Bot Defense signature: F5 documents it as an Application Visibility and Reporting (AVR) cookie. Distributed Cloud Bot Defense can disguise its injected JavaScript path, so confirm it from the protected-request telemetry flow or known site configuration instead of a universal cookie name. You can identify BIG-IP in a few lines. Send a plain request and print the status code plus cookies whose names start with `TS`: python```python import requests resp = requests.get( "https://www.ml.com/", headers={"User-Agent": "Mozilla/5.0"}, ) bigip_cookies = [c.name for c in resp.cookies if c.name.startswith("TS")] print("Status:", resp.status_code) print("BIG-IP cookies:", bigip_cookies) ``` On August 13, 2026, the live homepage returned: http```http Status: 200 BIG-IP cookies: ['TS012ec828', 'TS01454e7f'] ``` Those cookies establish BIG-IP ASM on the request path. They do not prove that Bot Defense classified the request or that the response was blocked; the same response contained the full initial homepage HTML. For Distributed Cloud Bot Defense, inspect the injected JavaScript and the telemetry attached to protected XHR, fetch, or POST requests. To compare confirmed signatures across vendors, see [How to Know What Anti-Bot Service a Website is Using?](https://scrapfly.io/blog/posts/how-to-know-what-anti-bot-website-uses). ## How Does F5 / Shape Detect Web Scrapers? F5 Distributed Cloud Bot Defense injects JavaScript into entry pages. The script collects environmental, behavioral, and other browser signals, then attaches telemetry to headers or the POST body of protected requests. For direct document GETs, F5 can serve an interstitial first so it can collect the same telemetry. ### The Shape custom JavaScript VM Shape's client code uses a virtual machine implemented in JavaScript, with opcodes randomized at frequent intervals. F5 also describes the design as bytecode-level obfuscation with telemetry encryption. The changing opcode map makes static reverse engineering expensive to maintain. ### Telemetry and the Shape AI Cloud The Shape Defense Engine applies real-time rules and sends telemetry to the Shape AI Cloud. Multiple machine-learning systems analyze automation and fraud patterns, and their findings feed new signals and rules back into the defense engine. F5's current reporting model exposes a Client Token for requests from the same web session and an expiring Bot Cookie that links requests. Its public docs do not publish one universal cookie name or fixed lifetime, so inspect the target's current flow instead of hardcoding either. ### Browser and device fingerprinting F5 reporting exposes browser, user, header, and device fingerprints alongside User-Agent, IP, and ASN. Keep those signals consistent across the protected flow. Do not claim a target checks Canvas, WebGL, or audio unless you observed those probes in its current JavaScript. [How Browser Fingerprinting Works and How to Defend Against It](https://scrapfly.io/blog/posts/how-browser-fingerprinting-works) covers the wider signal surface a protection script can inspect. ### IP reputation, headers, and deployment-specific network checks F5 combines client telemetry with request and network context. Its public docs do not define a universal JA3/JA4-first sequence, and they do not say every datacenter IP is rejected. Test the authorized endpoint and record which signal actually causes the block. The avoid-blocking series covers [How TLS Fingerprint is Used to Block Web Scrapers?](https://scrapfly.io/blog/posts/how-to-avoid-web-scraping-blocking-tls), [How to Avoid Web Scraper IP Blocking?](https://scrapfly.io/blog/posts/how-to-avoid-web-scraping-blocking-ip-addresses), and [How Headers Are Used to Block Web Scrapers and How to Fix It](https://scrapfly.io/blog/posts/how-to-avoid-web-scraping-blocking-headers) in more depth. [How to Bypass Kasada Anti-Bot When Web Scraping in 2026In this article, we'll take a look at the popular anti-bot service Kasada. How does it detect web scrapers and bots and what can we do to prevent our scrapers from being detected?](https://scrapfly.io/blog/posts/how-to-bypass-kasada-anti-scraping-waf) Scrapfly #### Need to bypass anti-bot protection? Scrapfly's Unblocker handles Cloudflare, DataDome, and more — automatically. [Try Free →](https://scrapfly.io/register)## How to Bypass F5 / Shape BIG-IP Bot Defense and Distributed Cloud Bot Defense enforce different browser checks. BIG-IP can require a browser to complete a JavaScript challenge and return a valid cookie. Distributed Cloud Bot Defense requires the injected JavaScript telemetry on protected requests. In both cases, run the authorized flow in a real browser and preserve its cookies and session state, or use a managed bypass that does this for you. A plain HTTP client can fetch unprotected HTML, but it cannot execute injected JavaScript or produce the browser telemetry required by a protected endpoint. Shape also randomizes its VM opcodes frequently, which makes a static decoder expensive to maintain. Do not assume a mobile API is unprotected. F5 supports mobile endpoints through its native SDK. Use an official mobile API only when the operator authorizes it and documents its access rules. The `ml.com` homepage is useful for identifying BIG-IP, not for demonstrating a block. The same [Use Curl Impersonate to scrape as Chrome or Firefox](https://scrapfly.io/blog/posts/curl-impersonate-scrape-chrome-firefox-tls-http2-fingerprint) call returned full initial HTML in this review: python```python from curl_cffi import requests resp = requests.get("https://www.ml.com/", impersonate="chrome") print("Status:", resp.status_code) print("Bytes:", len(resp.text)) ``` http```http Status: 200 Bytes: 93785 ``` That dated result establishes that the homepage was not a failing baseline on August 13, 2026. Use an authorized endpoint that actually rejects missing F5 telemetry before presenting blocked-versus-bypassed output. ## Bypass F5 with Scrapfly Enable Anti Scraping Protection to let Scrapfly detect the anti-bot stack and select the required proxy and browser resources. `render_js=True` explicitly renders this example in a cloud browser; `country="us"` selects US egress but does not force residential proxies. python```python from scrapfly import ScrapflyClient, ScrapeConfig client = ScrapflyClient(key="YOUR_SCRAPFLY_KEY") result = client.scrape(ScrapeConfig( url="https://www.ml.com/", asp=True, render_js=True, country="us", )) content = result.scrape_result["content"] print("Status:", result.scrape_result["status_code"]) print("Bytes:", len(content)) ``` The byte count is diagnostic only. Page size changes as scripts and content change, so validate an endpoint-specific marker before calling a request unblocked. The `ml.com` homepage is a configuration example here, not bypass proof, because the plain client already returned its initial HTML. Scrapfly's current F5 page reports 95% success specifically on F5 BIG-IP ASM targets. It also documents session reuse and states that failed bypasses are not charged. Python, TypeScript, Go, and Rust SDKs wrap the same API. See the [F5 bypass page](https://scrapfly.io/bypass/f5) for current coverage. ScrapFly's [Web Scraping API](https://scrapfly.io/products/web-scraping-api) is a single HTTP endpoint for collecting web data at scale, with residential and datacenter proxy coverage in **190+ countries**. - [Anti-Scraping Protection bypass](https://scrapfly.io/docs/scrape-api/unblocker) - detects and handles anti-bot systems including Cloudflare, DataDome, Imperva, PerimeterX, Akamai, and F5. - [Smart proxy rotation](https://scrapfly.io/docs/scrape-api/proxy) - residential and datacenter pools with country and ASN level geo-targeting. - [JavaScript rendering](https://scrapfly.io/docs/scrape-api/javascript-rendering) - render SPAs and dynamic pages through real cloud browsers. - [Browser automation scenarios](https://scrapfly.io/docs/scrape-api/javascript-scenario) - scroll, click, fill forms, and wait for elements without managing a browser fleet. - [Format conversion](https://scrapfly.io/docs/scrape-api/getting-started#api_param_format) - return pages as HTML, JSON, clean text, or LLM ready Markdown. - [Session management](https://scrapfly.io/docs/scrape-api/session) - keep cookies, headers, and IPs consistent across multi step flows. - [Smart caching](https://scrapfly.io/docs/scrape-api/getting-started#api_param_cache) - cache successful responses to cut cost on repeat scraping jobs. - [Python](https://scrapfly.io/docs/sdk/python), [TypeScript](https://scrapfly.io/docs/sdk/typescript), [Scrapy](https://scrapfly.io/docs/sdk/scrapy), and [no-code integrations](https://scrapfly.io/docs/integration/getting-started) including Make, n8n, Zapier, LangChain, and LlamaIndex. ### Power your scraping with Scrapfly Forget about getting blocked. Scrapfly handles anti-bot bypasses, browser rendering, and proxy rotation so you can focus on the data. [Try for FREE!](https://scrapfly.io/register) ## FAQ Is it legal to scrape F5 or Shape-protected pages?Scraping rules depend on the jurisdiction, the data, the site's terms, and the access controls involved. Get legal advice for the specific target and do not access non-public data without authorization. Is F5 Shape Security the same as F5 BIG-IP?No. BIG-IP ASM/Advanced WAF Bot Defense runs on BIG-IP and can expose `TS*` and `TSPD_101*` cookies. F5 Distributed Cloud Bot Defense evolved from Shape Enterprise Defense and uses injected JavaScript telemetry plus cloud inference. A deployment can use both. Did F5 acquire Shape Security?Yes. F5 completed its acquisition of Shape Security in January 2020 after announcing an approximately $1 billion transaction in December 2019. Does F5 use the reese84 cookie?No. `reese84` is an Imperva/Incapsula challenge, not an F5/Shape token. F5's public docs describe deployment-specific client tokens, bot cookies, and telemetry without publishing one universal cookie name or lifetime. What kinds of sites use F5 or Shape?F5 documents protection for login, account creation, booking, checkout, and scraping-sensitive flows across web and mobile applications. On BIG-IP, check for `TS*` or `TSPD_101*`; for Distributed Cloud Bot Defense, inspect the protected-request telemetry flow or confirmed site configuration. Can I bypass F5 or Shape with datacenter proxies alone?A proxy alone does not produce the browser telemetry F5 expects. IP and ASN are signals alongside browser, device, header, and behavior data, and a residential IP is not a universal requirement. Test the authorized target's actual flow. ## Summary F5 exposes two distinct paths. `TS*` identifies BIG-IP ASM, and `TSPD_101*` is tied to BIG-IP Bot Defense; `f5_cspm` is an AVR cookie. Distributed Cloud Bot Defense, which evolved from Shape Security, can disguise its injected JavaScript path. Shape's VM-based JavaScript obfuscation collects environmental and behavioral signals and attaches telemetry to protected requests. A browser-backed fetch is required when an endpoint enforces that telemetry. For production scraping, enable Scrapfly ASP and test the authorized endpoint for the expected content. Scrapfly's public 95% figure applies to F5 BIG-IP ASM, and failed bypasses are not charged. See the [F5 bypass](https://scrapfly.io/bypass/f5) page for current coverage. Legal Disclaimer and PrecautionsThis tutorial covers popular web scraping techniques for education. Interacting with public servers requires diligence and respect: - Do not scrape at rates that could damage the website. - Do not scrape data that's not available publicly. - Do not store PII of EU citizens protected by GDPR. - Do not repurpose *entire* public datasets which can be illegal in some countries. Scrapfly does not offer legal advice but these are good general rules to follow. For more you should consult a lawyer. [ Add as a preferred source ](https://google.com/preferences/source?q=scrapfly.io) Table of Contents Table of Contents- [Key Takeaways](#key-takeaways) - [What is F5 Bot Defense?](#what-is-f5-bot-defense) - [How to Identify an F5 / Shape Block](#how-to-identify-an-f5-shape-block) - [How Does F5 / Shape Detect Web Scrapers?](#how-does-f5-shape-detect-web-scrapers) - [The Shape custom JavaScript VM](#the-shape-custom-javascript-vm) - [Telemetry and the Shape AI Cloud](#telemetry-and-the-shape-ai-cloud) - [Browser and device fingerprinting](#browser-and-device-fingerprinting) - [IP reputation, headers, and deployment-specific network checks](#ip-reputation-headers-and-deployment-specific-network-checks) - [How to Bypass F5 / Shape](#how-to-bypass-f5-shape) - [Bypass F5 with Scrapfly](#bypass-f5-with-scrapfly) - [FAQ](#faq) - [Summary](#summary) Join the Newsletter Get monthly web scraping insights Scale Your Web Scraping Anti-bot bypass, browser rendering, and rotating proxies, all in one API. Start with 1,000 free credits. No credit card required 1,000 free API credits Anti-bot bypass included [Start Free](https://scrapfly.io/register) [View Docs](https://scrapfly.io/docs/onboarding) Not ready? Get our newsletter instead. ## Related Articles [ http nodejs ### Axios vs Fetch: Which HTTP Client to Choose in JS? Explore the differences between Fetch and Axios - two essential HTTP clients in JavaScript - and discover which is best ... ](https://scrapfly.io/blog/posts/axios-vs-fetch) [ headless-browser scaling ### Web Scraping With Cloud Browsers Introduction cloud browsers and their benefits and a step-by-step setup with self-hosted Selenium-grid cloud browsers. ](https://scrapfly.io/blog/posts/web-scraping-with-cloud-browsers) [ python blocking ### How to Scrape Air France Flights with Python in 2026 Scrape Air France round-trip flight offers with Python and the Scrapfly Cloud Browser API: walk the booking widget, capt... ](https://scrapfly.io/blog/posts/how-to-scrape-air-france-flights) ## Related Questions - [ Q What is HTTP cookies role in web scraping? ](https://scrapfly.io/blog/answers/http-cookies-in-web-scraping) - [ Q How to configure Python requests to use a proxy? ](https://scrapfly.io/blog/answers/python-requests-proxy-intro) Bypass anti-bot protection automatically, **1,000 free credits** [Start Free](https://scrapfly.io/register)