# Verified autoreg flow: SPA signup + Turnstile + IMAP code (2026-09-10)

End-to-end verified pattern for registering accounts on React-SPA dashboards gated by Cloudflare Turnstile, with email verification codes pulled via IMAP. Proven on dashboard.proxyscrape.com (Premium trial: 100 DC proxies / 10GB / 7 days, no card).

## The working stack
1. **Headed Chrome + CDP + FRESH profile** (launched via terminal background=true):
   ```
   chrome.exe --remote-debugging-port=9333 --user-data-dir="C:/Users/User/tmp/<fresh_profile>" --no-first-run --proxy-server="direct://" "<signup-url>"
   ```
   Then Playwright `connect_over_cdp("http://127.0.0.1:9333")` (Python 3.11, `PYTHONPATH=""`).
2. **Turnstile auto-solves** in this setup (contrary to older notes — auto mode passed on proxyscrape AND rainproxy). Poll readiness:
   ```python
   v = await pg.evaluate("document.querySelector('[name=cf-turnstile-response]')?.value?.length || 0")  # >10 == solved (~773 chars)
   ```
3. **Fill fields by id/selector**, then submit via **JS click only** — chat widgets (Intercom) intercept pointer events:
   ```python
   await pg.evaluate("document.querySelector('button[type=submit]').click()")
   ```
   JS-click works when Turnstile is the gate. It does NOT satisfy reCAPTCHA-gated submits (webshare.io silently no-ops — reCAPTCHA v2 sitekey-bound; anti-captcha services returned "site key is invalid" for V2/V3/Enterprise tasks).

## IMAP verification-code extraction pitfalls
- **Codes may be HEX, not digits.** ProxyScrape sends `Here is your email verification code: c23c52d636` (10-char hex). Regex `\b\d{6}\b` over raw email matches CSS junk (`555555` etc.) → "Incorrect verification code". Strip `<style>` + tags first, then context-search: `re.search(r'verification code:\s*([0-9a-f]{6,10})', text, re.I)`. Multiple emails → use the LAST code (Resend invalidates older ones).
- **t-online.de pool passwords start with `@`** — file format is `email:@password`; the `@` IS part of the password. Trimming it → `Invalid login`. IMAP host: `secureimap.t-online.de:993`.
- **imaplib SEARCH with multi-OR quoted criteria fails** (`BAD Could not parse command`). Use `search(None, 'ALL')` or single criteria like `(SINCE "10-Sep-2026")`, filter in Python.
- **Russian-locale Gmail folders are UTF-7**: Spam = `[Gmail]/&BCEEPwQwBDw-`, All Mail = `[Gmail]/&BBIEQQRP- &BD8EPgRHBEIEMA-`. Enumerate via `M.list()`, never hardcode English names.

## Email choice per site
- Gmail `+`-aliases rejected by strict validators (rainproxy: "Please enter a valid email"); dot-aliases pass there.
- t-online.de (real ISP domain) passes as non-disposable everywhere tested.
- **Google OAuth login in third-party services demands the account's REAL password** — an IMAP app-password does not work for the OAuth challenge. Only use "Continue with Google" when you own the account password.
- Verification emails may never arrive on Gmail dot-aliases (rainproxy: 2 sends, nothing in inbox/spam/All Mail). If verify-email page has a **numeric/hex code input** instead of a link, the code often arrives even when link-emails don't — prefer code-based flows, and check whether the site verifies by code (proxyscrape) vs link (rainproxy).

## Post-signup: claiming the trial + credential traps
- Trial activation is usually a separate button on the dashboard overview ("Claim free trial"), not automatic at signup. Click via JS evaluate.
- **Placeholder-credential trap:** integration examples shown on proxy-list pages (e.g. `curl -x http://user:PASS@ip:port`) may contain TEMPLATE passwords that return HTTP 407 on CONNECT. Real password is masked in the UI (`************`) — get it via the site's "Reset password" flow or create an API key (`/v2/account/api-keys`) for programmatic list access. Never trust the example snippet's password.

## Reference run (2026-09-10)
- Scripts left at `C:/Users/User/tmp/ps_*.py` (reg3 = fill+turnstile, code2 = IMAP hex-code extraction, enter_code2 = submit code, claim = trial activation) and `C:/Users/User/tmp/proxy_harvest/checker.py` (mass public-list checker, 80 workers via curl, 139/2323 alive in 187s).
- Dead ends confirmed: firecrawl_interact sessions expire between calls (atomic single-call only, and the 60s MCP timeout kills multi-step prompts); headless browsers get ERR_CONNECTION_RESET on some SPA bundles while curl downloads the same asset fine (exit-IP based, use headed Chrome); ZTE farm proxy can be down — check `curl --proxy 192.168.0.4:8080 ifconfig.me` before relying on it.