How DataDome Detects Bots

Recognizing DataDome

DataDome publishes the names of what it stores. Its cookies and stored data page (updated October 14, 2026) lists a cookie named datadome, used "for both server-side and client-side detection to assess the legitimacy of a request", with a one-year lifetime. A short-lived dd_testcookie checks whether the browser can store cookies at all, and session storage keeps the original referrer while a challenge is running.

On the page itself, the JavaScript Tag loads from js.datadome.co and sends what it collects to api-js.datadome.co, unless the site routes it through its own domain. When a request is blocked, the challenge page comes from captcha-delivery.com, usually inside an iframe. If you see that domain in your browser's network panel after a failed request, you are looking at a DataDome response.

The response pages documentation names the three pages a visitor can meet:

• Device Check, a short interstitial that verifies the device and then redirects to the page you asked for.
• A CAPTCHA, which DataDome now ships as a slider with an audio alternative.
• A block page, which refuses the request outright.

Site owners can brand these pages, so the logo and colors vary between sites while the domains stay the same.

Device and behavior signals

DataDome's threat detection page (updated August 17, 2026) says its models "use machine learning techniques and are continuously updated" and sorts them into four groups.

What the JavaScript Tag collects

According to the JavaScript Tag documentation, the script gathers behavioral data such as mouse movements and keystrokes, along with general information about the operating system, browser and GPU. It also runs consistency checks aimed at headless Chrome, Puppeteer and Selenium. DataDome states that it avoids invasive techniques such as canvas fingerprinting in the tag itself.

The tag also wraps XMLHttpRequest and fetch so it can catch a blocked API call and show the challenge in place. That detail matters for single-page apps: a background request can be challenged while the page around it looks normal, and a script that only checks status codes sees an unexplained 403.

What Device Check does

The Device Check page (updated July 31, 2026) describes it as acting "like a CAPTCHA, without prompting any challenge to the end user". It runs a set of client-side checkpoints, including proof checks on JavaScript function results, canvas rendering and execution times, then reports to DataDome, which decides to block or forward the visitor. DataDome uses it when a request looks like a bot but the evidence is not strong enough to block, or when the requested resource is sensitive. A verified visitor is remembered, so the check does not repeat on every page.

Because Device Check involves no interaction, behavioral models cannot score it. It is pure device and environment fingerprinting, which is why a patched automation browser that moves the mouse convincingly can still fail it.

Network reputation

The reputational family is the part people mean when they say a proxy was "detected". DataDome's wording is careful: an address may have been "recently associated with malicious activity or identified as a data center or residential proxy" by its models, and because addresses are shared, it "combines IP reputation with other criteria".

Three practical consequences follow.

1. Hosting ranges start at a disadvantage. A request from a cloud provider's range is easy to classify, and most real visitors do not browse from one.
2. Shared addresses are judged with context. Mobile carriers place many subscribers behind carrier-grade NAT, so one address can carry several people at once. Blocking such an address outright would block real customers, which is one reason reputation is combined with other signals rather than used alone. Our explainer on CGNAT and mobile trust covers the mechanics.
3. History follows an address. If a line was recently used aggressively, its reputation reflects that. A dedicated line used by one customer only has the history its owner gives it, which is the main reason dedicated access is easier to reason about than a shared exit.

You can see how public databases classify an address with the IP reputation check and the ASN lookup. Neither shows DataDome's private score, but both show the network label every detection system starts from.

The network layer also has a timing problem. DataDome's server-side modules call its API and wait a short time for a verdict; the Node.js module documents a default timeout of 150 milliseconds, after which the request is allowed. That design keeps sites fast, and it is also a reminder that most of the decision is made from data the request already carries.

Configuring a collector that stays consistent

This section assumes you have permission: your own property, a partner's site under contract, a QA engagement, or public pages whose terms allow automated access. In that situation the aim is not to look human. It is to avoid looking contradictory.

• Use one real browser engine per session, in headed mode, with a persistent profile. Keep the version current.
• Make the identity coherent. The user agent, client hints, language headers, time zone and screen size should describe one device. If the exit IP is in Germany, the browser should not insist it is in California.
• Keep one session on one IP. DataDome's cookie and session storage tie verdicts to a session, and switching addresses mid-session is a contradiction the reputational and signature models can both see. Rotate between sessions, never during one.
• Pace like a person. The behavioral family looks for activity no human produces, and DataDome customers can add custom rate-limit rules. A queue that spaces requests per host is cheaper than a block.
• Follow links instead of enumerating URLs. Walking predictable paths is exactly what the vulnerability-scanner family is built to notice.
• Check for leaks. WebRTC or DNS that reveals a second network location gives the site two answers to one question. Run the WebRTC leak test and the DNS leak test from the same browser profile.

For mobile web and app QA, a carrier line makes the session match the audience the site serves. Coronium's mobile proxies are physical devices with their own SIM, rented to one customer per line, over HTTP or SOCKS5, with the IP changed from the dashboard, the API, a rotation link or a timer. Use the timer only between sessions; a rotation in the middle of a checkout flow is the contradiction described above.

When a challenge still appears, treat it as information. A Device Check that passes means the environment looked acceptable; a slider means the score was borderline; a block means something specific was wrong. Change one variable at a time and note which change moved the outcome. Our proxy detected guide walks through that order of checks.

Using official data access first

Most sites that pay for DataDome also publish a sanctioned way to get data: a partner API, an affiliate feed, a data license or an export for customers. Those routes have stable formats, documented limits and a contract that says you may use the result. A collector that fights a bot-defense layer has none of those things.

DataDome itself documents a path for automated clients that want to be recognized. Its bot authentication page (updated June 16, 2026) says that "any automated request coming from an unauthenticated bot or AI agent is categorized as Threat Detection and is blocked by default". To be identified instead, an operator uses a dedicated user agent, sets up one of five verification methods (Web Bot Auth signatures based on RFC 9421 HTTP Message Signatures, two-way reverse DNS, a static IP list, a published dynamic IP list or a private autonomous system), and submits a request. Each site owner then decides whether verified bots of that category may enter.

The verified bots list shows how many legitimate categories exist: comparators, competitive intelligence, data providers, SEO software, media monitoring and more. If your business fits one of them, verification is a better investment than any client configuration. For AI agents, DataDome's Agentic Trust product adds per-agent policies, and our guide to why AI agents get blocked explains how signing fits in.

The legal side is the same as for any protected site. Terms of service, database rights, privacy law and computer misuse statutes all apply, and they differ by country. Our overview of whether web scraping is legal is a starting point, not legal advice.

Frequently asked questions