A clean IP address is just the first gate. Modern anti-bot systems like Akamai Bot Manager correlate a dozen independent signals - TLS fingerprints, sensor cookies, header order, behavioral patterns - to block you even with a residential proxy.
The proxy myth
Most developers think the bottleneck in web scraping is IP reputation. Buy a residential proxy pool, rotate IPs, and you're done.
That was true five years ago. It isn't anymore.
A residential or mobile proxy solves exactly one problem: IP-based blocking. Modern anti-bot systems like Akamai Bot Manager, Cloudflare, and DataDome don't block on IP alone. They correlate multiple independent signals and score the session across all of them. A clean mobile IP gets you past the first gate. The next eleven gates still block you.
What Akamai actually checks
- TLS fingerprinting (JA3/JA4) Every TLS handshake advertises cipher suites, extensions, curves, and ordering. Browsers have specific fingerprints. Python HTTP clients have different ones. Akamai fingerprints the ClientHello before your request even reaches the application layer.
Your proxy IP is irrelevant. The handshake comes from your HTTP client, not the proxy.
HTTP/2 fingerprinting
H2 SETTINGS frames, WINDOW_UPDATE values, header table size, priority frames. Browsers send these in a specific configuration. Python HTTP clients send them differently. Akamai checks.The sensor cookie
Akamai's sensor.js collects 50+ browser telemetry signals and compiles them into a blob stored in the _abck cookie. This includes:
Canvas rendering hashes
WebGL GPU vendor and renderer strings
Audio context fingerprints
Installed font enumeration
Screen resolution, color depth, pixel ratio
Navigator properties (hardwareConcurrency, deviceMemory, platform)
Timing precision (performance.now, Date.now)
Math engine quirks (how the browser computes specific operations)
No valid _abck cookie? Blocked. Valid cookie but sensor data doesn't match a real browser? Blocked.
Browser integrity
navigator.webdriver, headless detection, missing Chrome app objects, CDP artifacts, automation framework traces in the DOM. Akamai checks all of them.Behavioral analysis
Mouse movement patterns (bezier curves vs linear jumps), click timing, scroll behavior, key press cadence, navigation flow, dwell time between page loads. Zero dwell time is a bot signal. Direct deep-link navigation without visiting the homepage first is a bot signal.Header order and values
Browsers send HTTP headers in a specific sequence. Python clients typically send them in alphabetical or insertion order. Missing sec-ch-ua headers or wrong accept-language values are flagged.Cookie chain validation
Akamai tracks the full cookie lifecycle: bm_sz to ak_bmsc to _abck. If the chain doesn't match expected progression, the session is blocked. A fresh proxy IP with no prior Akamai cookies is suspicious - real browsers have persistent cookies from previous visits.
The correlation problem
Here's the key insight: Akamai doesn't block on any single signal. It scores the session across all dimensions.
A mobile proxy passes signal 1 (IP reputation). But if your TLS fingerprint says Python aiohttp (signal 2), your H2 fingerprint doesn't match any browser (signal 3), you have no _abck cookie (signal 4), and your headers are in the wrong order (signal 7), the combined score crosses the blocking threshold.
It doesn't matter how clean the IP is. The correlation kills you.
What actually works
To pass Akamai, every signal has to agree with every other signal. Your TLS fingerprint has to match your claimed browser. Your H2 settings have to match that same browser. Your headers have to be in the right order with the right values. Your sensor cookie has to contain telemetry from a real browser session. Your timezone has to match your IP geolocation. Your GPU string has to match a GPU that ships in devices with your claimed OS.
This is why headless Chrome via CDP with injected fingerprints is the only reliable approach. Real Chrome produces a coherent signal across all dimensions simultaneously. Python HTTP clients cannot.
The infrastructure layer
Building this yourself means maintaining:
A Chrome pool with CDP integration
TLS fingerprint matching via curl_cffi or similar
Fingerprint injection (canvas noise, GPU matching, font lists, timezone alignment)
Cookie chain management across crawls
Behavioral simulation (mouse movement, scroll, dwell time)
Navigation warmup (homepage visits before deep links)
Header generation that matches browser patterns
Proxy rotation with subnet diversity tracking
None of this is your product. All of it has to work, or nothing else matters.
This is the infrastructure layer we're building at KLOAKD. One API. Anti-bot evasion, fingerprint management, proxy rotation, CAPTCHA solving, session persistence - all handled. Your agent calls one endpoint and gets clean HTML back.
We're accepting founding members now. The first 500 shape the product, lock in lifetime pricing, and get direct access to the founding team.
Join the Founding Beta > https://kloakd.dev/
Top comments (0)