Blocked by Datadome

[juhacz]

Description:

I’ve been using CloakBrowser on my home computer for several months, specifically for accessing https://www.allegro.pl/. At first, there were some problems. I reported these issues in the issue tracker at #16. All the problems were eventually resolved, and everything worked fine until Saturday. Since Saturday, every attempt to access www.allegro.pl results in a message stating that I’m blocked.
I updated the version from 4.x to 5.2, but nothing changed. I also tried the Pro version using the key from https://cloakbrowser.dev/free/, with the same result. As soon as I open the browser, I’m blocked.

CloakBrowser version: 0.4.x and 0.5.2

Wrapper: Python

Environment: Debian 13 on VM in Proxmox

Launch options:

  browser = await launch_persistent_context_async(
        user_data_dir=browser_profile_path,
        humanize=True,
        human_preset="careful",
        headless=False,
        timezone="Europe/Warsaw",
        geoip=True,
        locale="pl-PL",
        args=[
            "--fingerprint-fonts-dir=/usr/share/fonts/windows",
            "--fingerprint=23029",
            "--fingerprint-platform=windows",
            "--fingerprint-hardware-concurrency=8",
            "--fingerprint-gpu-vendor=NVIDIA Corporation",
            "--fingerprint-gpu-renderer=NVIDIA GeForce RTX 3070",
            "--disable-http2"
        ]
    )

Tested with a different IP or proxy?
My home has internet through a local provider. On another computer in the house with a Windows system, using the same IP address, the internet works just fine.

Error output / screenshots:

[Cloak-HQ]

Thanks for the detailed report, and for sticking with us since #16.

What actually changed

You are right that something shifted around that time. DataDome tightened up on Allegro roughly two weeks ago, and the main way it shows up is IP reputation. They have been burning residential and proxy ranges aggressively since then.

We have been testing Allegro since their change. Exits that reliably passed for us before are now blocked, and entire provider pools are burned end to end, not just individual IPs. Some ranges are burned so badly that even stock Chrome on a real Windows machine gets blocked on them, with no automation involved at all. That is the clearest sign that it is the network being judged, not the browser.

Across binary versions the result is the same: on a clean exit it passes, on a burned exit it is blocked. The browser version is not the deciding factor here, the network reputation is.

Allegro passes on our end, confirmed again today on the current Pro build (150.0.7871.114.3) against the live site.

Your case specifically

You mentioned a Windows machine works fine on the same home connection. That tells us your IP is clean, so the burned-range problem above is not what is hitting you. Good news, because that one is the harder problem.

In your case the issue is in your launch args. They are doing too much.

You are manually setting the GPU vendor, GPU renderer, hardware concurrency, the platform, and a custom font directory. The binary already generates a complete, internally consistent device profile from the fingerprint seed, so GPU, hardware, canvas, fonts and the rest all match each other automatically. When you hand-set only some of those values on top, they fall out of sync with the rest of the generated profile, and with DataDome now scrutinising harder, that inconsistency is exactly the kind of thing that gets caught.

Use this instead. It is what our own passing Allegro test runs:

from cloakbrowser import launch_persistent_context_async

browser = await launch_persistent_context_async(
    user_data_dir=browser_profile_path,
    headless=False,
    humanize=True,
    human_preset="careful",
    geoip=True,
    args=["--fingerprint=23029"],
)

That is the entire configuration. We kept your fixed seed, since a stable seed with a persistent profile on a stable connection is the right approach. Everything else is handled for you. On Linux the Windows profile is applied automatically, the GPU and hardware values are generated coherently from the seed, and geoip sets the timezone and locale from your connection.

Also run:

cloakbrowser info

It tells you whether your binary is current, whether the browser launches, and whether the required Windows fonts are present. Since you are running a Windows profile on Debian, an incomplete Windows font set (Segoe UI, Calibri, Consolas) is a detectable signal on its own. Install any that are missing system-wide, rather than pointing at them with a font directory flag.

Start a fresh profile directory when you switch to the config above, so the old profile's state does not carry over.

One last thing if you ever move this off your home connection to a VPS or proxy: given how much has been burned recently, the exit you land on will matter more than anything else in your config.

Let us know how that works out for you.

[juhacz]

Thank you for your reply.

Replacing parameters with the proposed values:

browser = await launch_persistent_context_async(
    user_data_dir=browser_profile_path,
    headless=False,
    humanize=True,
    human_preset="careful",
    geoip=True,
    args=["--fingerprint=23029"],
)

nothing has changed. I also removed the directory from the “browser_profile_path” variable, which is stored at /dev/shm/. Moving from Windows and installing the Segoe UI, Calibri, and Consolas fonts along with their various variations helped resolve the issue. After that, cloakbrowser no longer displays the error message mentioned above, and the problem with allegro.pl is no longer present.

loakBrowser diagnostics
Wrapper:   0.5.2
Python:    3.13.5
OS:        Linux x86_64
Platform:  linux-x64
Channel:   Stable
Version:   150.0.7871.114.3 (pro) — next launch
Latest:    150.0.7871.114.3 (up to date)
Binary:    /home/juha/.cloakbrowser/chromium-150.0.7871.114.3-pro/chrome
Installed: True
Cache:     /home/juha/.cloakbrowser/chromium-150.0.7871.114.3-pro
Launch:    ✓ CloakBrowser 150.0.7871.114.3
Win fonts: partial (4/8)
           → incomplete Windows font set; copy real Windows fonts (Segoe UI, Calibri, Consolas)
Office fonts: absent (0/10)
License:   Free (latest binary, 1 concurrent session)
           For more than one concurrent session → https://cloakbrowser.dev
Sessions:  0 seats in use
GeoIP DB:  present
Modules:
  playwright: ok
  geoip2: ok
  aiohttp: ok
  websockets: missing

What other fonts should I install, since 4 fonts are still missing?

Thank you for your help.

[Cloak-HQ]

Great news, and thanks for confirming the fix. That is a useful data point: the fonts were the whole story here.

The best advice is simple: copy the entire C:\Windows\Fonts folder from a real Windows machine, not just individual fonts. Our check looks at 8 fonts, but that is a minimum set, not a complete one. Different sites fingerprint different fonts, so one site may probe for fonts that another never touches. The closer your font set is to a genuine Windows install, the fewer of these gaps you will hit. It is also worth searching for published Windows font lists to fill in anything your source machine is missing.

For reference, these are the 8 our check looks for, so you can see which 4 you are still missing:

• Segoe UI
• Segoe UI Light
• Calibri
• Marlett
• MS UI Gothic
• Franklin Gothic
• Consolas
• Courier New

Install them system-wide (for example into /usr/local/share/fonts, then run fc-cache -f -v), including the style variants as you already did.

On the Office fonts: they are not required, and having none of them is a perfectly normal Windows setup, since roughly half of real Windows machines do not have the Office pack. That is why we report it as information rather than a warning. That said, installing them does help. They add another block of genuine Windows fonts to your profile, which makes it look more like a fully used machine and gives you more to match against on sites that probe for them. If you have access to a Windows machine with Office installed, just copy its fonts folder over as well.

Two small unrelated notes while you are in there. Your diagnostics show websockets: missing, worth installing to avoid surprises later. And since you moved your profile directory to /dev/shm/, keep in mind that it is cleared on reboot, so if you want the reputation benefit of an aging persistent profile, store it on disk instead.

Glad it is working again.

[juhacz]

I’ve copied all the fonts with the *.ttf extension. There’s still one font missing, so I have 7/8 of the required fonts. In Office, all 10 fonts are present. I’ve also installed WebSockets. Everything is working fine now.
Thank you for your help and work.