AWS WAF

Functional

AWS WAF loaded on 49 sites in our October 2026 scan: 2% of the 2,450 most-visited sites we checked, before any visitor had given consent.

Category: Functional. A company can do several jobs; this is its main role on the pages we saw.

Its cookies typically last about 4 days. Only 29% of the sites where it loaded had a consent banner visible at all. It's especially common on .it sites: 5% of them load it, versus 2% of all sites we scanned.

About AWS WAF

AWS WAF is a web application firewall and bot-management product built into Amazon Web Services.

It runs a background challenge to distinguish automated traffic from real visitors, setting a token in a cookie such as aws-waf-token before letting a request through. It isn't counted as a tracker here, since it exists to filter bots, not to profile visitors.

Often loaded alongside

Sites that load AWS WAF most often also load Google (31%), Google Ads (31%), Amazon Advertising (29%), Google Analytics (27%), and OneTrust (16%).

Domains it loads from

1c5c1ecf7303.7a63328c.eu-central-1.token.awswaf.com
c07df3ce4b34.6286c813.eu-central-1.token.awswaf.com
static.captcha.awswaf.com
06ab2c0e8fdd.edge.sdk.awswaf.com
d8c14d4960ca.5b2b76d5.eu-central-1.token.awswaf.com
904c3c506090.834e6c76.eu-central-1.token.awswaf.com
31bcb4af0667.edge.sdk.awswaf.com
fe4385362baa.8b5e35b0.eu-central-1.token.awswaf.com
de5282c3ca0c.edge.sdk.awswaf.com
323701e7ef4e.edge.sdk.awswaf.com
323701e7ef4e.6913f1a1.eu-central-1.token.awswaf.com
4422a912521b.edge.sdk.awswaf.com
043df3d55a9e.947e1d2c.us-east-1.token.awswaf.com
0692f8bdd7b5.edge.sdk.awswaf.com
0692f8bdd7b5.edge.captcha-sdk.awswaf.com
366170c95788.7a0de154.eu-central-1.token.awswaf.com
a69fe2e4a041.800956ec.eu-central-1.token.awswaf.com
b9493eb8140d.e570b7be.eu-west-2.token.awswaf.com
b9493eb8140d.e570b7be.eu-west-2.captcha.awswaf.com
380ce6d4f3e0.edge.sdk.awswaf.com
a795a81af32a.e42c74f6.eu-central-1.token.awswaf.com
cb54f00a05b3.d9e9ff35.eu-west-1.token.awswaf.com
c09bc9c04079.edge.sdk.awswaf.com
3f0fb9bcf568.edge.sdk.awswaf.com
5474cb65a01c.18c71156.eu-central-1.token.awswaf.com

Cookies

aws-waf-token47 sites

Sites that load AWS WAF

The highest-ranked 30 of 49 sites.

amazon.com33 tracking companies
booking.com1 tracking company
amazon.de1 tracking company
espn.com0 tracking companies
amazon.co.jp1 tracking company
ieee.org2 tracking companies
amazon.ca1 tracking company
amazon.in1 tracking company
amazon.it1 tracking company
wattpad.com3 tracking companies

Show 20 more sites

amazon.com.br1 tracking company
amazon.com.au1 tracking company
binance.com0 tracking companies
amazon.com.mx34 tracking companies
huggingface.co0 tracking companies
jw.org0 tracking companies
marktplaats.nl4 tracking companies
dribbble.com0 tracking companies
themoviedb.org1 tracking company
mamastar.jp5 tracking companies
alphapolis.co.jp9 tracking companies
amazon.eg1 tracking company
espn.com.ve0 tracking companies
playinboss.com1 tracking company
intercom.com0 tracking companies
wayground.com0 tracking companies
samsungknox.com1 tracking company
semanticscholar.org3 tracking companies
coinmarketcap.com1 tracking company
howstuffworks.com1 tracking company

Understanding this page

What the tracker categories mean
What "advertising," "analytics," "social," "consent" and the rest actually mean for a company or a cookie, and how CookieTosser decides which one applies.
First-party vs third-party cookies (and why "first-party" still tracks you)
What the distinction actually means technically, why browsers only block one of the two, and how CNAME cloaking, server-side tagging and cookies like _ga let sites keep tracking under their own domain.
How to block or limit trackers
Browser privacy settings, content blockers, Global Privacy Control and clearing cookies compared honestly — what each one actually stops, what it doesn't, and what it costs you in return.