there a youtuber called code bullet who made a bot to play jstris, but the website bot detection got him and banned him and he tried to use the following methods:

• new account
• incognito
• clear browsing data and cookies
• VPN
• different browser

but every time the website tells him that he is banned, so that mean the website track the user by something and I don’t think it is IP address since he used a VPN and it still didn’t work, and I don’t think its cookies or browser related because he used different browser and still got him

I wanna know what is that something so that I can add to my website and track users data or progress without the need for them to login

I tried many fingerprinting methods but each one fails to give a unique fingerprinting through incognito, VPN and different browser