If curl-impersonate works, it's probably TLS fingerprinting.