Proxies for American Airlines: Scraping Through the NDC War

American Airlines spent 2024 fighting its own distribution, and the fight is why reading its fares got harder. It pulled a large share of fares off the systems travel agencies use, told travelers they would earn miles only by booking direct or through an approved channel, and then walked parts of it back when the revenue did not follow. The result is fares that move between channels and a website, aa.com, that sits behind one of the toughest bot-management stacks in travel. Proxies for American Airlines are the tool for reading those fares the way a traveler in each market sees them, on a schedule, without the fare search deciding your request is a robot.

We run a proxy network, and American Airlines traffic reaches us from fare trackers, corporate travel teams and travel-data vendors. This page covers what is specific to AA: the NDC distribution war and why it matters for data, how Akamai guards the fare search, which proxy type fits and how to size it. The sector background is in travel fare aggregation, the metasearch that carries AA fares is Google Flights, and the closest siblings are proxies for Delta and proxies for United.

What proxies are best for American Airlines?

Rotating residential proxies behind a real browser, pinned to the market whose fares you want, with a static residential (ISP) exit for anything on an AAdvantage account. American runs Akamai Bot Manager on its fare search, which scores the TLS handshake and the browser before the IP, so home connections and a real browser are both required. There is no strong point-of-sale pricing game on AA the way there is on a European carrier, but matching the market still keeps the visitor consistent. Reach for mobile only when a run keeps drawing 403s.

The NDC war, and why it moved the data

For most travel sites the interesting question is how they block you. For American Airlines the interesting question is where the fares even are, because the airline spent 2024 moving them.

In February 2024 American withdrew about 40% of its fares from the traditional Global Distribution System that travel agencies rely on, and announced that AAdvantage miles and loyalty points would be earned only on bookings made through aa.com, an American or partner site, a corporate account, or a "preferred agency" that books at least 30% of its trips through American's New Distribution Capability (Travel Research Online). The American Society of Travel Advisors called the move a clear abuse of market power, and one industry writer described it as American expanding its war against travel agents to now punish travelers (Cranky Flier).

It did not go to plan. Amid cut revenue and profit forecasts, American reversed parts of the plan in May 2024, rolling back the AAdvantage earning restrictions for bookings made through non-NDC agents (TravelPulse). But the direction did not change: American still intends for NDC to carry about 80% of its bookings (The Points Guy).

For a data team the lesson is that AA fares are a moving target across channels: some on aa.com, some through NDC connections that only approved sellers reach, fewer on the old GDS than there used to be, and a subset on metasearch. A tracker that reads only one channel reads an incomplete fare picture, and the completeness of that picture is exactly what changed.

How American Airlines blocks you

American's fare search sits behind Akamai Bot Manager, the same class of defense guarding United, Delta and Lufthansa. Akamai does not judge the IP alone: it fingerprints the TLS handshake (the JA3/JA4 signature computed from your ClientHello before any HTTP is sent), reads the browser's JavaScript environment and behavioral telemetry, and assigns a trust score, and a standard Python client whose cipher suites look like a bot is issued a 403 before the request reaches the application layer (ScrapingBee, Python flight scraper). On top of that, aa.com ships the fare page as a near-empty shell and loads the prices with JavaScript afterward, so a plain request gets a page with no fares in it.

Two things follow. The proxy has to be a residential address Akamai's trust score does not start by distrusting, and the client has to be a real browser whose handshake and behavior match a human. Fixing one and not the other leaves you at the 403.

Which proxy type fits: residential, datacenter, ISP, or mobile

Datacenter proxies fail the Akamai trust score first; in published testing a datacenter proxy returned 403 even with correct headers while the same request through residential cleared the page. Use them only to develop a parser against a saved page.

Rotating residential proxies are home connections from a large pool, one per search, rotated between, pinned to the market. They carry the trust score that gets you past Akamai when paired with a real browser (background in what is a residential proxy).

ISP proxies are static residential addresses for anything on an AAdvantage account, where the session must hold on one exit.

Mobile proxies are carrier addresses shared by many phones, the last resort for runs that keep drawing challenges.

Free versus paid for American Airlines

A free proxy is a shared datacenter address, exactly what Akamai's trust score rejects first, and it will not survive a fare search behind Bot Manager. A single fare check from another country will sometimes load through a free proxy, and our free proxy list and proxy checker make that free. For a tracker, paid residential behind a real browser is the floor; ours starts at $0.44/GB pay-as-you-go with no KYC, so a first run costs cents.

Setting it up

Drive a real browser behind a residential exit; our guides for Playwright and Puppeteer cover the wiring. Build the search directly, wait for the fares to render, and keep the browser's own TLS and header order intact, because those are what Akamai reads first. Rotate one IP per search for public fares and hold a sticky ISP exit for AAdvantage sessions, the split explained in rotating vs static residential proxies. Read AA fares across more than one channel, because the NDC shift means no single channel carries the whole fare picture any more.

How many IPs, and how fast

Sizing (rotating residential, one refresh cycle):
  searches/cycle = routes x dates
                 = 400 routes x 60 dates = 24,000 searches
  per search     = a browser render behind Akamai; block images and fonts
  per address    = a few searches, then rotate

Refresh near-term dates daily, far dates weekly. The pool spreads it.

Our pricing is per gigabyte with no expiry, so the cost follows the grid you read.

Staying unblocked on American Airlines

• Residential IP plus a real browser. Akamai scores both; one without the other is a 403.
• Keep the handshake honest. The TLS fingerprint is Akamai's most effective vector, so do not let a scripting library announce itself.
• One search per address, then rotate. No single IP should look like a tracker.
• Read more than one channel. The NDC shift split the fare picture; a single channel is incomplete.
• Back off on the first 403. A block from one address is a signal to slow the schedule, not to hammer through it. The checklist is in avoiding IP bans while scraping.

The limits worth knowing

Proxies give an American Airlines fare read a trusted address and spread a tracker across enough of them that the fare search sees passengers. They do not clear Akamai on their own, because half of its score is the client, they do not reunite a fare picture the airline deliberately split across channels, and they do not change AA's terms of service. Read across channels, drive a real browser, and size from searches.

A single manual read costs nothing on our free proxy list, checked with the proxy checker. For a fare tracker, rotating residential at $0.44/GB pay-as-you-go behind a real browser, one search per address, is what reads American Airlines.

Sources

• Travel Research Online, American Airlines announces changes on fees and NDCs, on the 40% GDS withdrawal and the AAdvantage earning rules.
• Cranky Flier, American expands its war against travel agents to now punish travelers.
• TravelPulse, American Airlines changes course on AAdvantage and NDC implementation.
• The Points Guy, American wants you booking direct, on the 80% NDC target.
• ScrapingBee, how to build a Python flight scraper, on Akamai Bot Manager, JA3/JA4 and the JavaScript shell.