DataDome

DataDome sits in front of your site, app and APIs and decides in a few milliseconds whether each request is a bot, a human, or something worth challenging. It uses device and behavior signals, its cross customer threat network, and machine learning, and it can serve its own puzzle or block outright. Beyond bot blocking it covers scraping, credential stuffing, card testing, and account fraud.

It deploys as a module on most CDNs and servers. Everything is visible in a dashboard with per request explanations, which is friendlier to fraud and T&S teams than some pure security bot products.