# IP-Quota Registration + Proxy Rotation (terrapolis-class sites)

For sites that cap accounts per IP per time window (e.g. 3 accounts/IP/30 days) behind Cloudflare Turnstile.

## Core rule: free proxy pools cannot scale IP-quota sites

Quota is GLOBAL per exit IP, and public proxies are shared — other people's registrations burn the slots. Observed yield on "turnstile-capable" free proxies: ~6/24 with the rest failing as `no redirect: <site main-page text>` (= quota exhausted or server-side rejection). A proxy that passed the Turnstile filter minutes ago can still fail the quota check. Do not plan capacity on free pools.

## Working approach: sticky residential sessions

1024proxy DE residential (creds in tmp/aws_kiro/smart_proxy.py, `UP_AUTH`):
```
http://prxg746509-region-de-sess<N>:<pw>@hk.1024proxy.io:3000
```
Each new `<N>` = fresh unique DE exit IP. `cloakbrowser.launch(headless=True, proxy=url)` accepts the auth'd URL form directly — no separate auth handling.

Wave math and discipline:
- Capacity = quota-per-IP × fresh sessions. Budget exactly `quota` accounts per session (3/3 for terrapolis), never more.
- Per session, FIRST test once before burning quota: fetch `https://api.ipify.org?format=json` inside the browser page for the exit IP + solve the native Turnstile on the register page (token length > 100 within ~50s). Only then run the account loop on that same browser/session.
- Keep a burned-IP file (one IP per line, e.g. `terr_px_used_ips.txt`); skip any session whose exit IP is already in it.
- Expect ~50-60% of residential sessions to fail Turnstile or land on a used IP — provision ~2x sessions for the target account count.
- Cost is trivial: a browser registration wave is ~5-10MB/account; residential traffic is billed per GB.

## Proxy source notes (tested from this host)

- **ProxyGrab API** `http://[REDACTED-IP]:43888/proxies` with `X-API-Key` (key in tmp/ablit_autoreg/.proxygrab.json): response is `{ok, count, proxies:[{proxy:"http://ip:port", protocol, latency_ms, country, anonymity}]}` — the full URL lives in the `proxy` FIELD; parsing `host`/`ip` keys returns 0 items. Paginate with `limit`/`offset`. Routes: only `/proxies` and `/stats`.
- **TheSpeedX** `raw.githubusercontent.com/TheSpeedX/PROXY-List/master/http.txt`: ~2600 lines; 800 tested → ~46 conn-live → 0 Turnstile-capable. Good for plain connectivity only, useless for captcha-walled sites.
- **geonode proxy-list API**: frequently ConnectionError from this host — do not depend on it.
- **Local proxy_bot DB** (Desktop/proxy_bot/proxies.db, table pool, alive=1): best free source historically (~12/25 Turnstile-capable), but quotas burn out after one wave.

## Filter pipeline (reusable shape)

Union of sources → threaded conn-test against the register page (60 workers, 8s timeout, `requests` with proxies dict) → cloakbrowser Turnstile test (5 workers max — browser RAM; wait for `input[name=captcha]` value length > 100, ~30-60s) → save TS-good list → wave script rotating `proxies[(i // per_ip) % len]`.

## Failure triage

- `no redirect: <main page text>` after submit → quota burned OR server reject; retest the proxy's exit IP quota before touching the script.
- Turnstile token never appears → proxy dead/slow mid-test, not a script bug; rotate.
- Verify email never arrives (voidash poll timeout) → separate problem from proxy; check voidash `/api/v1/messages` with Bearer session key.