How to Identify the Anti-Bot Vendor From a Single Response

Read this table top-to-bottom. The first row that matches the response wins — vendors do not stack on the same hostname and path, so once a row matches you have your answer.

The cheapest reliable detector is a regex over the Set-Cookie headers (the headers where the server hands you cookies), with the Server header as a tiebreaker for Cloudflare. Work through these in order:

1. Cookies first. Match the cookie names above against the response Set-Cookie headers. Akamai, DataDome, PerimeterX, Kasada, and F5 Shape all set distinctive names on the very first response, so this alone usually identifies the vendor.
2. Server header second. Server: cloudflare plus cf-ray confirms Cloudflare is in front, but a Cloudflare site with Bot Management turned off looks identical to one with it on. Look for cf-mitigated or a Turnstile script tag to tell the two apart.
3. HTML body third. If you got an HTML response, search the script src attributes: sensor.js (Akamai), /cdn-cgi/challenge-platform/ (Cloudflare), captcha-delivery.com (DataDome), px-cdn.net (PerimeterX), challenges.cloudflare.com (Turnstile).
4. Block body fourth. Once you are blocked, the page itself is diagnostic — Pardon Our Interruption is Akamai, Just a moment… is Cloudflare, and the captcha-delivery.com iframe is DataDome.

Three cookies do more than just mark a vendor's presence — they carry session state (a status the cookie tracks as your session progresses) that the site's background requests check on every call:

• _abck (Akamai) — its state field reads ~-1~ on first contact (you are untrusted) and flips to ~0~ (trusted) only after sensor.js POSTs valid signals to /_bm/data. While the cookie is still ~-1~, protected endpoints return 412 Pardon Our Interruption no matter how good your TLS or IP is.
• _px3 (PerimeterX) — carries a risk score baked into the cookie. Pre-validated cookies are sold on grey-market resellers because a clean _px3 is worth more than a clean IP.
• cf_clearance (Cloudflare) — issued after you pass a challenge, and tied to your IP plus User-Agent. Change either one and it stops working.
• reese84 (F5 Shape) — rotates roughly every minute, so long-lived sessions require constant token re-acquisition — one reason in-house integrations against Shape are costly to maintain at scale.

Identifying the vendor explains how a site is built more than the site's own design does. Each product has a distinct architecture worth understanding when you integrate with a service you are permitted to access:

• Akamai — frequently deployed on the web front-end while a brand's mobile API uses a simpler architecture; the web tier leans heavily on TLS-handshake and behavioural signals.
• Cloudflare — a CDN with optional Bot Management and Turnstile layers; the same hostname can range from no bot product at all to full ML scoring, which is why the tiebreaker step matters.
• DataDome — scores every request independently rather than building trust across a session, so IP reputation weighs heavily in its model. Some sites also embed data in __NEXT_DATA__ in the initial HTML.
• PerimeterX (HUMAN) — reputation is shared across all of its customer sites, so a single fingerprint signal is evaluated network-wide rather than per-site.
• Kasada — inspects client code with Function.prototype.toString(), which is why runtime JS patching is detectable and source-level approaches behave differently.
• F5 Shape — a custom JS VM with minute-by-minute token rotation, the most engineering-intensive product to integrate against, which is why managed APIs are common for it.