How to Scrape G2 & Capterra Reviews in Python Bypassing DataDome (2026 Guide)

Zenkdom — Fri, 30 Oct 2026 11:51:18 +0000

If you have ever tried extracting B2B SaaS reviews, product comparisons, or pricing tiers from G2.com or Capterra, you have almost certainly run headfirst into a wall of 403 Forbidden errors or an interactive DataDome slider puzzle.

In this guide, we will analyze:

What triggers DataDome's anti-bot detection on G2.
Why standard libraries like requests, BeautifulSoup, and vanilla Playwright fail.
How to extract clean review data and star ratings using Python.

1. What Makes DataDome So Difficult?

Unlike basic web scrapers that only check your User-Agent string, DataDome operates on multiple layers:

A. TLS / JA3 / JA4 Fingerprinting

Before your script even sends the HTTP GET request, your Python client performs a TLS handshake with G2's edge servers.

Python's default urllib3 (used by requests and httpx) uses system OpenSSL cipher suites in an order that screams "I am an automated Python script".
DataDome matches this against its signature database and drops the connection before returning any HTML.

B. Device & Mouse Telemetry

If you render with headless Chrome, DataDome inspects:

navigator.webdriver flags
chrome.runtime object bindings
Mouse coordinate curves (linear robotic movements vs authentic human Bezier curves)
Missing speech synthesis and WebGL vendor mismatches

2. The Traditional Approach (And Why It Costs So Much)

To solve this locally, developers typically stitch together:

patchright (stealth Playwright fork) to remove Chrome DevTools Protocol (CDP) leakages.
Residential proxy pools ($10-$15 per GB) because datacenter IPs (AWS, Hetzner, DO) are blacklisted by default.
CAPTCHA solving services ($2 per 1,000 solves) that add 15-20 seconds of latency.

Managing this infrastructure for high-volume extraction quickly turns into a full-time DevOps nightmare.

3. The Modern Solution: Automated Bypass via Parse Everything

Instead of hosting heavy headless browsers that consume 1.5 GB of RAM per worker, you can use Parse Everything. It handles JA3/JA4 TLS impersonation, Turnstile/DataDome challenge clearing, and residential IP routing behind a single API call.

Prerequisites:

Python 3.8+
A free API key from parse-everything.com (includes 1,000 free requests on sign-up).

pip install requests

4. The Complete Extraction Script

Here is a working Python script to extract product titles, review ratings, and review snippets from G2:

import requests
import json

API_KEY = "pe_live_YOUR_API_KEY"
TARGET_URL = "https://www.g2.com/products/slack/reviews"

payload = {
    "target_url": TARGET_URL,
    "render_js": True,           # Renders dynamic reviews DOM
    "auto_detect": True,         # Automatically solves DataDome challenges
    "country_code": "US",
    "selectors": {
        "product_name": "h1",
        "review_cards": ".nested-ajax-container",
        "review_titles": "h3.review-title",
        "review_body": ".review-body"
    }
}

headers = {
    "Authorization": f"Bearer {API_KEY}",
    "Content-Type": "application/json"
}

print(f"[*] Extracting G2 reviews from {TARGET_URL}...")
response = requests.post(
    "https://parse-everything.com/api/v1/extract",
    headers=headers,
    json=payload,
    timeout=60
)

data = response.json()

if response.status_code == 200 and data.get("status") == "success":
    extracted = data["data"]
    print(f"[+] HTTP Status: {extracted['http_status']}")
    print(f"[+] Page Title: {extracted['page_title']}")
    print(f"[+] Protection Bypassed: {extracted['protection_bypassed']}")
    print(f"[+] Execution Time: {extracted['execution_time_seconds']}s")

    print("\n--- Structured Selectors Data ---")
    print(json.dumps(extracted.get("selectors_data", {}), indent=2))
else:
    print(f"[-] Failed: {data}")

5. Output Preview

{
  "http_status": 200,
  "page_title": "Slack Reviews 2026: Details, Pricing, & Features | G2",
  "protection_bypassed": "DataDome Device Telemetry & WAF",
  "execution_time_seconds": 4.82,
  "selectors_data": {
    "product_name": ["Slack Reviews and Pricing"],
    "review_titles": [
      "Indispensable tool for real-time remote collaboration",
      "Great communication app for agile engineering teams",
      "Essential daily messaging app with incredible integrations"
    ]
  }
}

Summary

Never send raw requests.get() to DataDome targets — you burn your IP reputation.
If running locally: use curl_cffi for TLS impersonation or patchright with residential proxies.
If running in production at scale: save developer hours by offloading anti-bot evasion to parse-everything.com.

Scraping Real Estate Data: How to Bypass Cloudflare Turnstile on Zillow in Python

Zenkdom — Fri, 30 Oct 2026 11:48:08 +0000

Real estate intelligence relies on real-time property listings, price drops, and historical sales data. However, portals like Zillow, Redfin, and Realtor.com deploy strict Cloudflare Turnstile and PerimeterX defenses.

In this tutorial, you'll learn how to scrape listing prices, addresses, and property specs without triggering 403 blocks or endless verification loops.

1. Why Zillow Blocks Your Scraper

When you fetch a Zillow listing with Python, three things happen simultaneously:

TCP/TLS Handshake Inspection (JA4): Cloudflare examines the order of cipher suites and TLS extensions in the Client Hello packet.
HTTP/2 Fingerprinting: Cloudflare checks the SETTINGS frame values, initial window sizes, and header capitalization order.
Turnstile JavaScript Challenge: If any anomaly is detected, an interactive or invisible Turnstile challenge executes, demanding clearance tokens (cf_clearance).

Standard Python libraries fail on step 1 before the challenge script even runs.

2. Fast Solution: Parse Everything API

Instead of configuring residential proxy rotations and headless browsers, you can extract Zillow listing data directly through Parse Everything.

Features Used:

Autonomous Cloudflare Bypass: Passes Turnstile with zero manual human interaction.
CSS Selectors Mode: Extracts only the prices, beds/baths, and square footage directly into JSON.
Sub-Second Execution: No heavy browser launch needed when TLS spoofing succeeds.

3. Python Extraction Script

import requests
import json

API_KEY = "pe_live_YOUR_API_KEY"  # Get 1,000 free credits at parse-everything.com
ZILLOW_URL = "https://www.zillow.com/homes/for_sale/Austin-TX/"

headers = {
    "Authorization": f"Bearer {API_KEY}",
    "Content-Type": "application/json"
}

payload = {
    "target_url": ZILLOW_URL,
    "bypass_cloudflare": True,
    "country_code": "US",
    "selectors": {
        "prices": "[data-test='property-card-price']",
        "addresses": "[data-test='property-card-addr']",
        "links": "a.property-card-link"
    }
}

print(f"[*] Querying Zillow via Parse Everything API...")
response = requests.post(
    "https://parse-everything.com/api/v1/extract",
    headers=headers,
    json=payload,
    timeout=45
)

result = response.json()

if response.status_code == 200:
    data = result["data"]
    print(f"[+] HTTP Status: {data['http_status']}")
    print(f"[+] Bypassed: {data['protection_bypassed']} in {data['execution_time_seconds']}s")

    selectors = data.get("selectors_data", {})
    prices = selectors.get("prices", [])
    addresses = selectors.get("addresses", [])

    print(f"\n[+] Found {len(prices)} property listings:")
    for price, addr in zip(prices[:5], addresses[:5]):
        print(f"  • {price} — {addr}")
else:
    print(f"[-] Error: {result}")

4. Key Takeaways

Bypass Cloudflare at the TLS layer to reduce latency from 10 seconds to 300 milliseconds.
Always use US residential proxies when querying US-specific real estate portals.
Filter data using server-side CSS selectors to keep payloads lightweight.

DEV Community: Zenkdom