Download websites that use Kasada

About Kasada

A bot mitigation product on a website is a statement about who has been trying to get in. Kasada, founded in 2015 and sold as a Proprietary service, exists for sites where automated traffic is a business problem rather than a nuisance, credential stuffing against login endpoints, price and inventory scraping, automated account creation, checkout automation against scarce stock.

We can observe the product because the defence has a client side. Kasada issues invisible cryptographic challenges to the browser instead of showing a puzzle to the visitor, and the challenge code has to reach the page, which leaves a fingerprint readable without ever solving it. As of October 2026 we detect Kasada on 5,740 sites.

The figure is small, and the smallness is the point. Defence of this class is bought by airlines, ticketing, retail with limited inventory, telecoms, gaming and financial services, and it is generally bought after an incident rather than in anticipation of one. A site carrying it has something worth automating against, has budget, and has usually been through a procurement process that its direct competitors are somewhere inside as well.

The list is therefore useful in opposite directions. Competing vendors in the anti bot market read it as an account map, with contract age implied by deployment age. Security and fraud teams read it as a peer list, since knowing which comparable businesses have decided this problem is worth paying for is the fastest way to justify or to challenge the same spend internally. Researchers studying the automation arms race read it as a measure of where defensive spending has actually landed rather than where vendors say it has.

Honesty matters more than usual for a product built to resist measurement. We see Kasada where the challenge is served in response to an ordinary request for a page. We do not see it where protection is applied only to login, checkout or API paths that a crawl never requests, and a deployment that fronts an application subdomain alone will not register against the main domain at all. The number should be read as the visible perimeter of the installed base rather than the whole of it, and for this category the invisible remainder is likely to be substantial.

Confirming that one airline runs Kasada takes a minute in a browser. Producing the population takes a crawl of the whole web, which is what the downloadable dataset is, with the domain, the detection date and the rest of each site's stack alongside it so that deployments can be segmented by industry, size and neighbouring technology rather than counted in the abstract.