GMB, Google, Youtube - CTR Bot Buidling

MostRerum said:

I’m also building a SERP bot of my own, but I’m very new to this space. It seems to require a lot of know-how, so I’ve been doing a huge amount of research. First of all, thank you for answering all my questions so openly and sincerely.
I’ve built a bot that creates browser sessions, searches for a specific keyword, simulates user-like mouse movements and browsing behavior, and then clicks the target result.
When I test the browser fingerprint on pixelscan.net/fingerprint-check, it is evaluated as **consistent**.
I’m planning to use the system with ISP/mobile rotating proxies, but as far as I understand, cookies are another important part of the setup. I’m not very familiar with what exactly needs to be considered on the cookie side.
For example, let’s say I have 100 Gmail accounts. If I manually log into these accounts, browse websites such as YouTube and Facebook for a while, and then export their cookies in Netscape format using the “Get cookies.txt” browser extension, would it make sense to randomly import cookies from one of those 100 accounts into each browser session created by my SERP bot?

Then the bot would search for the target keyword and click my domain. Could an approach like this help make the sessions look more established and potentially improve the effectiveness of the SERP activity?
Is this generally how cookies are handled in setups like this, or is there a different approach I should be researching?

Click to expand...

Honestly I'm very happy to meet like-minded people, its quiet hard, and I'm always interested in connecting, that is the right concept and the right mentality.

- Importing cookies is good, but cookies do carry a timestamp... they will expire, cookies + username + password + 2fa is important
- I noticed that proxies are not as important as the stubs you are using for the chrome accounts (you must add human mouse moving techniques) hope this helps https://github.com/Xetera/ghost-cursor
- check https://abrahamjuliot.github.io/creepjs/ to see if your browser is leaking anything
- At the moment from my personal test I'm getting 99% legit browser identities (windows, macos, linux, android, ios) so checking for leakeages is one of the most important things, the tests I have done are unimaginable, I spent weeks trying to figure out the best way to do it.
- The automation is the easiest part, I understand your workflow, search keywords, act like a human searching etc...
- You should avoid free stubs since you will need to do C++ injections on the stub releases, and update on every release.
- The test underneath the one in pixelscan failed on the collecting of the fingerprint (I try blocking some js that could reveal the identity of the browser)
- If your browsers are leaking anything forget about the interaction it just made because if pixels can can identify google already did, your interactions wont count in the long term, believe me.

This is my current formula = [90% chromium/firefox stub] + [8% proxy] + [2% correct scripting]

Hope that helps, and if you have any findings please share them

Thanks again for the detailed explanation. I’ve been doing more testing based on what you told me and I have a few questions I’d really like to get your opinion on.

This is the CreepJS result from my current browser setup:

https://imgur.com/a/XWZpHGR

From your experience, does anything in this report look incomplete, inconsistent, or suspicious from a fingerprint/leak perspective? Is there any specific value you would expect to see there that is missing, or any section you would personally focus on first when checking whether the browser identity is leaking?

I’m also trying to understand the cookie side much better.

When preparing existing Gmail accounts before exporting their cookies, do you think browsing websites related to the same niche actually makes any meaningful difference?

For example, I’ve heard people say that before exporting cookies they first use the account normally, search for keywords related to their niche, visit several websites from the search results, browse other sites in the same industry, and only then export the cookies.

Have you seen this approach before? Do you believe that browsing/search history actually gives the cookie/profile more value, or is that mostly misunderstanding how cookies and account history work?

The part I still don’t completely understand is what cookies actually contribute in this kind of browser workflow.

For example, imagine two otherwise identical test environments:

A) browser sessions using cookies from 100 established accounts + rotating mobile proxies
B) completely fresh browser sessions with no imported cookies + the same rotating mobile proxies

What would you expect the practical difference between those two environments to be?

I’m not asking only about whether the browser is logged in. I’m trying to understand what cookies really change from Google’s perspective.

Is there a concrete example where you would say:

“Without an established cookie/profile, this signal or behavior is missing.”

That would help me understand whether building a separate automation for preparing and maintaining browser profiles is actually worth the effort.

Right now I’m unsure how much weight I should give to cookies compared with fingerprint consistency, IP reputation, browser history, account age, and normal session behavior.

Another thing I’m investigating is CAPTCHA frequency.

With rotating mobile IPs, I still sometimes see Google challenges. My assumption is that even though the IPs are mobile, large proxy providers may have many customers using the same IP pools, so some addresses may already have a poor reputation.

In your experience, what tends to influence CAPTCHA frequency the most: IP reputation, ASN/carrier, rotation frequency, browser fingerprint consistency, account/session history, request patterns, or something else?

And if you know any mobile/ISP proxy providers whose IP pools have been consistently cleaner for normal browser testing, I’d be interested to hear which ones you’ve had good experiences with.

One more thing I’m curious about: when you say your formula is roughly 90% browser stub, 8% proxy, and 2% scripting, what are the top 3–5 fingerprint areas inside that “90%” that you personally consider the most important?

For example, if you had to audit a new browser build quickly, which signals would you check first before even worrying about mouse movement or automation logic?

I’m trying to understand the fundamentals properly instead of blindly adding more automation.

MostRerum said:

Thanks again for the detailed explanation. I’ve been doing more testing based on what you told me and I have a few questions I’d really like to get your opinion on.

...

Click to expand...

Good questions:

1.- I cant see the image you attached, do you mind pasting it on the image viewer
2.- For creepjs is basically a trial an error, I cant really mention the parts that are critical, but canvas + hardware are few of the essential ones.
3.- What I recommend is run multiple profiles tests, see which one performs the best with browser fingerprinting tests, grab the ones that work and run them in creepjs and see what they have in common, this will take time, but you can save the creepjs information for each profile that you generate with different fingerprints and begin from there, building up your personal working profiles, so the new profiles you generate have the characteristics and specifications that work.
4.- Regards the gmail cookies, as you may know cookies are basically encrypted data/tokens about your session, ultimately your session is stored with google, google has its own database of your usage with that browser, its something you cant monitor or cant see, ultimate, they have a sessions token that basically upon expiring you entering your gmail will either refresh it, or if the location and proxy is different then you will be prompt to re-login, you have to really research this, if you are looking into do "logged interactions" then you basically need something static, so static or server proxies should be fine just pay on demand for what you use, very cheap.
5.- In regards to the approach, yes I have seen it, since its something I do everyday, its totally normal, but do not manage accounts via cookies only, like I said its essential that you posses username / password + 2fa, that is how it has worked for me.
6.- preparing a script for mantaining profiles is essential very important.
7.- if you see google challenges doesnt mean that your browser is bad, rather it could also mean is the proxy used or the browser build is suspicious... it can always be either of those two, if any problem like that use capsolver.

Apologies if I cannot go in further details on some things.