Klook Reviews Scraper — Activity Reviews & Ratings (DRAFT, BLOCKED)

Status: BLOCKED — see ACCESS_PROBE.md. klook.com fronts its activity pages with a DataDome CAPTCHA challenge that curl_cffi, Camoufox, and — on the issue #82 retry — patchright + real Chrome + Xvfb (the most-trusted free browser fingerprint in the fleet) all fail to clear in-house; DataDome escalates to the same interactive puzzle widget every time. No in-house transport reaches review data. This directory holds the cloud discovery-probe used to establish that, kept as the investigation record. It is not a working scraper, does not pass the cloud gate, and is not published.

Intended shape (champion-parity target, issue #82)

Input: urls[] (Klook activity page URLs), max_review_per_page, sort_by, language, proxyConfiguration.

Output (10 champion-parity fields, per knagymate/klook-reviews-scraper):

page_id, page_url, review_id, time, content_original, content_translate, score, score_description, images[], like_count

Why it's blocked

See ACCESS_PROBE.md for the full rung-by-rung diagnosis. Short version: every activity-page navigation (curl_cffi direct, Camoufox browser render, patchright + real Chrome + Xvfb, and a bounded set of guessed sibling-service JSON endpoints) is served a DataDome CAPTCHA instead of content — patchright's real-Chrome fingerprint still gets escalated to the same interactive puzzle widget, on 3 separate cloud runs with fresh proxy sessions. The one confirmed-working keyless internal API (reused from the sibling klook-activity-price-tracker actor) only returns a review summary (star rating + count), not individual records.

What would unblock it

A managed-access service capable of clearing DataDome's interactive CAPTCHA — a COGS decision reserved for Bond, not made here. This is now the strongest BD candidate among the retry set: the free stack's best fingerprint (real Chrome + Xvfb) was actually tried and still escalated.

Usage statistics

This Actor creates a small, content-free summary at the end of each run. It is used only to monitor reliability and improve this Actor. A copy is saved as USAGE_STATS in your own Apify key-value store, so you can see the exact record created for your run.

Set disableUsageStats to true in the input to opt out. Nothing is sent then; your USAGE_STATS record only says that statistics were disabled.

Only these fields are recorded:

• schema version, Actor name and build number;
• UTC start and finish hour (not a precise timestamp);
• run duration, number of results and time to the first result, each as a coarse range;
• whether the result was empty, the end status, and an error type from a fixed list;
• memory setting and counts of charged events;
• names of the input fields you set, never their values;
• the selected option for input fields that offer a fixed list of choices (for example a sort order).

We do not collect input text, search terms, URLs, domains, usernames, email addresses, names, proxy credentials, tokens, scraped records, output items, raw error messages, stack traces, or hashes of any of those values. Records are kept for no longer than 13 months, used only as aggregated operational statistics, and never sold or shared.

Additional fields (Phase 2)

This Actor also records your Apify user ID, whether Apify marks the account as paying, the size range of list inputs, the selected country when the input offers a fixed list of countries, and one category from a fixed Actor taxonomy. We use these fields only for aggregate reliability, repeat-use and cross-Actor analysis; reports suppress any cell with fewer than five distinct users.

The same disableUsageStats: true input flag turns these fields off too. The user ID is removed after 13 months; we do not export, sell, share, or attempt to re-identify this data.

Run-outcome signals (v2)

To learn whether a run did what it was asked to do, the record also holds a few more coarse ranges and yes/no flags. None of them contains content:

• the result limit you asked for (a range, when the input has one) and what share of it was delivered;
• results delivered per input item you listed (a range);
• output quality as ranges: how fully the result fields were filled, the share of rows that look like errors, the share of duplicate rows, and how many different fields appeared. These are counted in memory while results are saved; no result content is kept;
• how the run was started (console, API, schedule, webhook, another Actor);
• how it ended: stopped by you, timed out, reached the requested limit, stopped by the charge limit, and how many times the platform moved the run;
• if this Actor reports it: how many items to process worked or failed (ranges) and one failure reason from a fixed list;
• a short code made from the names of the input fields you set, never their values.

Repeat-run fingerprint (v2)

When your Apify user ID is recorded (see above), the record also holds an 8-character one-way code made from your input (proxy settings left out) and this Actor's name. It only lets us see that the same account ran the same input again soon after an unsatisfying run; we never see the input itself. It is stored only in the database, never published, and reports use it in aggregate with the same five-user minimum. It is the one exception to the statement above that no hashes are collected, and disableUsageStats: true turns it off.