vlad/autoreg-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
209e142d443042a2d86342c948d06a76c09eb696
autoreg-skills-max/skills/windows-browser-automation/references/spa-trial-autoreg-verified-flow.md

4.4 KiB
Raw Blame History

Verified autoreg flow: SPA signup + Turnstile + IMAP code (2026-09-10)

End-to-end verified pattern for registering accounts on React-SPA dashboards gated by Cloudflare Turnstile, with email verification codes pulled via IMAP. Proven on dashboard.proxyscrape.com (Premium trial: 100 DC proxies / 10GB / 7 days, no card).

The working stack

  1. Headed Chrome + CDP + FRESH profile (launched via terminal background=true): 
    chrome.exe --remote-debugging-port=9333 --user-data-dir="C:/Users/User/tmp/<fresh_profile>" --no-first-run --proxy-server="direct://" "<signup-url>"
    Then Playwright connect_over_cdp("http://127.0.0.1:9333") (Python 3.11, PYTHONPATH="").
  2. Turnstile auto-solves in this setup (contrary to older notes — auto mode passed on proxyscrape AND rainproxy). Poll readiness: 
    v = await pg.evaluate("document.querySelector('[name=cf-turnstile-response]')?.value?.length || 0")  # >10 == solved (~773 chars)
  3. Fill fields by id/selector, then submit via JS click only — chat widgets (Intercom) intercept pointer events: 
    await pg.evaluate("document.querySelector('button[type=submit]').click()")
    JS-click works when Turnstile is the gate. It does NOT satisfy reCAPTCHA-gated submits (webshare.io silently no-ops — reCAPTCHA v2 sitekey-bound; anti-captcha services returned "site key is invalid" for V2/V3/Enterprise tasks).

IMAP verification-code extraction pitfalls

  • Codes may be HEX, not digits. ProxyScrape sends Here is your email verification code: c23c52d636 (10-char hex). Regex \b\d{6}\b over raw email matches CSS junk (555555 etc.) → "Incorrect verification code". Strip <style> + tags first, then context-search: re.search(r'verification code:\s*([0-9a-f]{6,10})', text, re.I). Multiple emails → use the LAST code (Resend invalidates older ones).
  • t-online.de pool passwords start with @ — file format is email:@password; the @ IS part of the password. Trimming it → Invalid login. IMAP host: secureimap.t-online.de:993.
  • imaplib SEARCH with multi-OR quoted criteria fails (BAD Could not parse command). Use search(None, 'ALL') or single criteria like (SINCE "10-Sep-2026"), filter in Python.
  • Russian-locale Gmail folders are UTF-7: Spam = [Gmail]/&BCEEPwQwBDw-, All Mail = [Gmail]/&BBIEQQRP- &BD8EPgRHBEIEMA-. Enumerate via M.list(), never hardcode English names.

Email choice per site

  • Gmail +-aliases rejected by strict validators (rainproxy: "Please enter a valid email"); dot-aliases pass there.
  • t-online.de (real ISP domain) passes as non-disposable everywhere tested.
  • Google OAuth login in third-party services demands the account's REAL password — an IMAP app-password does not work for the OAuth challenge. Only use "Continue with Google" when you own the account password.
  • Verification emails may never arrive on Gmail dot-aliases (rainproxy: 2 sends, nothing in inbox/spam/All Mail). If verify-email page has a numeric/hex code input instead of a link, the code often arrives even when link-emails don't — prefer code-based flows, and check whether the site verifies by code (proxyscrape) vs link (rainproxy).

Post-signup: claiming the trial + credential traps

  • Trial activation is usually a separate button on the dashboard overview ("Claim free trial"), not automatic at signup. Click via JS evaluate.
  • Placeholder-credential trap: integration examples shown on proxy-list pages (e.g. curl -x http://user:PASS@ip:port) may contain TEMPLATE passwords that return HTTP 407 on CONNECT. Real password is masked in the UI (************) — get it via the site's "Reset password" flow or create an API key (/v2/account/api-keys) for programmatic list access. Never trust the example snippet's password.

Reference run (2026-09-10)

  • Scripts left at C:/Users/User/tmp/ps_*.py (reg3 = fill+turnstile, code2 = IMAP hex-code extraction, enter_code2 = submit code, claim = trial activation) and C:/Users/User/tmp/proxy_harvest/checker.py (mass public-list checker, 80 workers via curl, 139/2323 alive in 187s).
  • Dead ends confirmed: firecrawl_interact sessions expire between calls (atomic single-call only, and the 60s MCP timeout kills multi-step prompts); headless browsers get ERR_CONNECTION_RESET on some SPA bundles while curl downloads the same asset fine (exit-IP based, use headed Chrome); ZTE farm proxy can be down — check curl --proxy 192.168.0.4:8080 ifconfig.me before relying on it.