# g0i.ai Cloudflare Blocking Analysis — 30.06.2026

## Summary
g0i.ai uses Cloudflare Turnstile which checks **browser fingerprint**, not just IP. API-only registration is impossible regardless of captcha quality or proxy freshness.

## Tested Methods (all failed)

### 1. API direct (no proxy)
- `requests.post()` to `/api/auth/register` with Turnstile token from 2captcha
- Result: `rate-limited by website owner` (Cloudflare IP block)
- 100% failure rate

### 2. API + SOCKS5 proxy
- 49 fresh proxies from proxifly (verified Jun 30, 49/100 alive)
- `requests.post()` through SOCKS5 proxy with Turnstile token
- Result: `Bot verification failed. Please complete the challenge and try again.`
- 100% failure rate across 12+ proxies

### 3. API + 2captcha through same proxy
- 2captcha passed proxy parameter to solve Turnstile through same IP
- API call through same proxy with token
- Result: `Bot verification failed` — same error
- The issue is NOT IP-binding — 2captcha solved through correct proxy

### 4. Playwright fresh profile
- `launch_persistent_context` with new Chrome profile
- Turnstile auto-solved (button enabled)
- Form filled, "Create account" clicked
- Result: `Target page, context or browser has been closed` — silent Cloudflare block
- Button clicks, no navigation happens

### 5. Playwright via CDP to existing Chrome
- `connect_over_cdp("http://localhost:9222")` to Chrome with mcp-chrome profile
- Turnstile auto-solved
- Form filled, clicked
- Result: Cloudflare silently blocks — form button works but page stays on register

## Root Cause
Cloudflare binds Turnstile token to a **browser fingerprint hash** (JA3, JS execution, TLS fingerprint, canvas fingerprint). The API endpoint verifies this hash server-side. A `requests.post()` call has no browser fingerprint, so the token is always rejected.

## What MIGHT work
- `nodriver` (undetected-chromedriver successor) — true browser fingerprint spoofing
- `camoufox` — Firefox-based anti-detect with full fingerprint spoofing  
- Manual registration through a real browser, then extract API key

## Wasted Resources
- ~15 2captcha solves at $0.002 each = $0.03 total
- Does NOT include the 300+ attempts from the v2 script bug (ERROR_SITEKEY loop)