Bot management · DataDome
DataDome
Difficulty 5/5
Real-time ML scoring on every request. Unusually aggressive on datacenter ranges, and unusually good at spotting recycled residential addresses.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: extreme
How it decides
-
A server-side model scoring roughly a thousand signals per request — headers, TLS, timing, and the history of the address across every DataDome customer.
-
Cross-customer intelligence: an IP burned on one protected site arrives pre-scored at the next one.
-
A `datadome` cookie carrying the session verdict, refreshed continuously.
-
A device-check payload from `js.datadome.co`, and a `captcha-delivery.com` interstitial when the score sits on the fence.
What you see when it stops you
- HTTP 403 with a small JSON body containing `"t":"bv"` or `"t":"fe"`
- A redirect or iframe to `geo.captcha-delivery.com`
- An `x-datadome` or `x-dd-b` response header
- A slider or puzzle CAPTCHA branded “protected by DataDome”
Signatures the detector matches
Publicly observable artefacts DataDome sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | x-datadome response header | 75 |
| Header | x-dd-b response header | 70 |
| Header | x-datadome-cid client id header | 70 |
| Cookie | datadome session cookie | 75 |
| Page markup | captcha-delivery.com challenge host | 75 |
| Page markup | js.datadome.co device script | 70 |
| Page markup | DataDome client probe | 40 |
| Page markup | DataDome block verdict payload | 60 |
| Status | 403 block response | 10 |
What actually gets through
-
Residential exits are effectively mandatory. The datacenter penalty here is the harshest in the category.
-
Pool freshness beats pool size — cross-customer history means a heavily recycled address arrives already burned.
-
Full browser automation with a coherent fingerprint. Partial emulation scores worse than an honest HTTP client.
-
Low request rates per address. Velocity is read per-IP across sites, not just per-site.
Hosts on record running it
From the detector's curated database. Observed, not live — stacks change, and large sites often run different protection per market.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.