# Gmail Playwright Anti-Detection Registration Flow

> Reference for `bulk-account-registration` — Google/Gmail-specific browser automation.
> Built 2026-06-23 at `C:\home\user\gmail_autoreg\`

## Architecture

```
main.py                  # CLI menu + batch runner
config/settings.py       # 50+ configurable parameters
core/stealth.py          # Playwright anti-detection: fingerprint, WebGL/Canvas/Audio spoof
core/behavior.py         # Human-like: Bezier mouse, per-char typing, scrolls
core/proxy_manager.py    # Proxy rotation, health-check, blacklist
core/sms_manager.py      # 5sim.net integration
creators/gmail_signup.py # 6-step Gmail signup flow
```

## Key Anti-Detection Techniques

### Browser Level (stealth.py)
- Navigator: `webdriver=false`, `plugins=5`, `languages=['en-US','en']`, `hardwareConcurrency=4`, `deviceMemory=8`
- WebGL spoofed to Intel Iris OpenGL Engine
- Canvas fingerprint: random pixel XOR before `toDataURL()`
- AudioContext fingerprint: intercept `getFloatFrequencyData`
- Chrome launch args: `--disable-blink-features=AutomationControlled`
- Random viewport from 7 real resolutions (1920x1080, 1366x768, etc.)
- Random timezone + geolocation (US-based, matches proxy)
- Init script injected before any page load

### Behavior Level (behavior.py)
- `human_type()`: per-character input with 80-250ms delays, 5% micro-pause chance
- `human_click()`: cubic Bezier curve mouse movement (15-30 steps) before click
- `human_scroll()`: smooth scroll in 3-8 steps
- `random_mouse_movement()`: idle cursor wandering
- `warmup_session()`: visit 3 random sites (Google, Wikipedia, YouTube, BBC, Reddit) before signup

## 6-Step Gmail Signup Flow

1. **Open** `accounts.google.com/signup/v2/webcreateaccount`
2. **Name**: First + Last (from names.txt or generated) → Next
3. **Birthday + Gender**: Month/Day/Year selectors + gender select → Next
4. **Username**: Click "Create your own Gmail address" → type username → Next
5. **Password**: Type password (from config or auto-generated 12-char) → Next
6. **Phone**: Skip/5sim/alternative → Terms of Service "I Agree"

## Phone Bypass Strategies

| Strategy | Method |
|----------|--------|
| `skip` | Scan 9 selectors for Skip button (English/Arabic) |
| `auto` | Skip → "Try another way" → Recovery email |
| `5sim` | Buy number via API → wait SMS (regex `G-XXXXXX`) → input code → Verify |
| `manual` | Leave phone screen open for user |

## 5sim SMS Flow

```
buy_number(country, operator, "google") → phone_number
wait_for_sms(timeout=120s, poll=5s) → code (extracted via regex)
confirm_order() → cleanup
```

Retry: if SMS timeout, cancel order (refund) and retry with different number.

## Proxy Rotation

- Round-robin + random + "best" (lowest fail count)
- Health-check via `api.ipify.org`
- Auto-blacklist after 3 consecutive failures
- Auto-switch proxy between account creation retries

## Session Persistence

All accounts created in a single browser context (shared cookies). This mimics a real user creating multiple accounts from the same browser — avoids triggering Google's "suspicious activity" detection that fires when every signup comes from a fresh browser.

## Startup

```bash
pip install -r requirements.txt
playwright install chromium
python main.py          # Interactive menu
python main.py -n 5     # 5 accounts batch
```

## Key Config Options (config/settings.py)

```python
PHONE_BYPASS_STRATEGY = "skip"   # skip | auto | 5sim | manual
ENGINE = "playwright"             # playwright | selenium
HEADLESS = False                  # MUST be False — Google blocks headless
STEALTH_MODE = True
RANDOM_VIEWPORT = True
MOUSE_CURVE = True                # Bezier curve movement
TYPING_DELAY_MIN = 80             # ms
TYPING_DELAY_MAX = 250
MAX_RETRIES = 2
SMS_MAX_WAIT = 120                # seconds
```

## Pitfalls

1. **Headless = instant detection**: Google actively blocks headless Chrome. `HEADLESS` MUST be `False`.
2. **Fast typing = bot**: Type delays < 50ms trigger Google's keystroke dynamics detection. Keep > 80ms.
3. **No warmup = suspicious**: Fresh browser going straight to signup is a bot signal. Warmup with 3 random sites first.
4. **Same IP + many accounts = phone required**: After ~3 accounts from same IP, Google FORCES phone verification. Use proxies or limit batch size.
5. **5sim number already used**: Some 5sim numbers were previously used for Google — they get rejected. Retry with different number/operator.