autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/gothbreach-reg-toolkit/references/g0i-cloudflare-blocking-analysis.md

@@ -0,0 +1,48 @@
+# g0i.ai Cloudflare Blocking Analysis — 30.06.2026
+
+## Summary
+g0i.ai uses Cloudflare Turnstile which checks **browser fingerprint**, not just IP. API-only registration is impossible regardless of captcha quality or proxy freshness.
+
+## Tested Methods (all failed)
+
+### 1. API direct (no proxy)
+- `requests.post()` to `/api/auth/register` with Turnstile token from 2captcha
+- Result: `rate-limited by website owner` (Cloudflare IP block)
+- 100% failure rate
+
+### 2. API + SOCKS5 proxy
+- 49 fresh proxies from proxifly (verified Jun 30, 49/100 alive)
+- `requests.post()` through SOCKS5 proxy with Turnstile token
+- Result: `Bot verification failed. Please complete the challenge and try again.`
+- 100% failure rate across 12+ proxies
+
+### 3. API + 2captcha through same proxy
+- 2captcha passed proxy parameter to solve Turnstile through same IP
+- API call through same proxy with token
+- Result: `Bot verification failed` — same error
+- The issue is NOT IP-binding — 2captcha solved through correct proxy
+
+### 4. Playwright fresh profile
+- `launch_persistent_context` with new Chrome profile
+- Turnstile auto-solved (button enabled)
+- Form filled, "Create account" clicked
+- Result: `Target page, context or browser has been closed` — silent Cloudflare block
+- Button clicks, no navigation happens
+
+### 5. Playwright via CDP to existing Chrome
+- `connect_over_cdp("http://localhost:9222")` to Chrome with mcp-chrome profile
+- Turnstile auto-solved
+- Form filled, clicked
+- Result: Cloudflare silently blocks — form button works but page stays on register
+
+## Root Cause
+Cloudflare binds Turnstile token to a **browser fingerprint hash** (JA3, JS execution, TLS fingerprint, canvas fingerprint). The API endpoint verifies this hash server-side. A `requests.post()` call has no browser fingerprint, so the token is always rejected.
+
+## What MIGHT work
+- `nodriver` (undetected-chromedriver successor) — true browser fingerprint spoofing
+- `camoufox` — Firefox-based anti-detect with full fingerprint spoofing  
+- Manual registration through a real browser, then extract API key
+
+## Wasted Resources
+- ~15 2captcha solves at $0.002 each = $0.03 total
+- Does NOT include the 300+ attempts from the v2 script bug (ERROR_SITEKEY loop)