Aluvia

Is it geo, Cloudflare, Imperva, or a login wall?

This page as markdown: https://aluvia.io/resources/triage-geo-cloudflare-imperva.md

Updated · Aluvia

A decision tree for operators whose Grok Bot or other cloud agent runs Chrome on a US AWS (or similar) datacenter IP and then stalls on a challenge, a block card, a region message, or a page that looks like login. Match the string on the screen to a branch. Each branch says what the site is doing, when a residential exit helps, when it does not, and the exact commands to try.

Before you branch

Record the exact error, the current URL and whether the page requires authentication. A region message, challenge or failed button does not identify the cause on its own.

Aluvia is a local CLI on the same VM. The agent installs it, picks a country when needed, and sends the existing Chrome through a residential IP. Sticky sessions last up to 30 minutes. Aluvia is not a human VPN, not for streaming or live video, not an MCP, and not a login bypass. Country only, not city. It does not change fingerprint, Linux Chrome, TLS, or canvas. A residential IP sometimes clears a 403, CAPTCHA, Cloudflare challenge, or Imperva Error 16. Sometimes. Not a promise.

Branch A — Wrong country / geo not available

Strings you may see include "Not available in your region," "This content is not available in your country," "We don't ship to your location," "bot VM was from a location not typically used by me," geo blocked, wrong country, a catalog, currency, language, or tax line that matches the datacenter country instead of the market you need, or a storefront that never offers the region you expected, with no Ray ID and no Imperva incident card.

A location warning can reflect an account security rule as well as IP location. Follow the site’s account recovery or wait instructions when present.

A site may choose a country page from the IP address. A saved country, language preference, shipping address or account setting can cause a similar result. Check those settings before testing an IP change.

If the evidence points to IP location, select the required country from aluvia geos, reload and verify the actual catalog. GB and NZ are examples for the UK and New Zealand, subject to current availability. Sticky sessions last up to 30 minutes; check the page before continuing the task.

Aluvia does not help for streaming or live video, for city / GPS / timezone / Accept-Language spoofing, or for a content licence that forbids the region regardless of IP. Further reading: not available in your region, change a cloud agent's IP location, Grok Bot.

Branch B — Cloudflare challenge or CAPTCHA that returns

Grok Bot can also see a 人机验证 (human check) when creating an API key in the Cloudflare dashboard. It can keep failing when the operator takes over the computer and clicks it by hand. A residential IP sometimes helps if the evidence points to an IP refusal; a failed takeover alone does not establish that cause.

Strings you may see include "Verify you are human," "Captcha required (version 2)," hCaptcha, "Checking if the site connection is secure," "Please verify you are a human," "Sorry, you have been blocked," Error 1020, Error 1015, a CAPTCHA that comes back after every solve, or a Ray ID in the page footer.

Operators sometimes call the cloud computer IP address “Box IP” or “Cloudflare Box IP.” On a site such as Kleinanzeigen, the IP can be one input to a security check. The label does not establish the cause of a failed request.

A challenge can involve the IP, browser behavior, cookies, or access rules. A Ray ID identifies a request, not its root cause. Error 1015 requires waiting and fewer requests; Error 1010 is a browser-signature block. Check the error code.

If an IP-related refusal remains after setup, try aluvia rotate-ip once and reload. Stop if the result does not change. For a rate limit, wait and reduce requests. Select a country only when the task requires one and it appears in aluvia geos.

A Create button that does nothing after a CAPTCHA does not prove an IP block. Check the request result and page error first; application, session, and network failures can look similar. Test a different IP only when the evidence points there.

A declined payment is not proof of an IP block. Check the payment or page error and follow the provider's instructions; do not retry payments by rotating IPs.

Aluvia does not help if the page already names fingerprint, Linux Chrome, TLS, or canvas as the failure and the IP already looks residential, if you need a guarantee that every Cloudflare challenge clears, or if a normal login form is already on screen waiting for credentials or 2FA. Further reading: Cloudflare, CAPTCHA, 403, unusual traffic, rate limit.

Branch C — Imperva Error 16 / security service block

Strings you may see include "Error 16," "This request was blocked by our security service," "Access denied" on a card that also says Imperva, "Your IP" / "Proxy IP" / "Incident ID," "Powered by imperva," or hostnames that still show on the card while the rest of the site is missing. Trade shops are a common shape.

Imperva Error 16 identifies a security-service refusal. The card does not by itself establish whether IP classification, country, browser checks or another access rule caused it. Record the Incident ID and compare the request conditions before choosing a test.

A residential IP sometimes helps with an IP-related refusal. Inspect setup, select an available country if needed and reload. Try one rotation only if the refusal remains; stop if it still fails.

The address bar can show /login while the card is still Imperva's security service, not a credential form. Aluvia changes the exit IP so the request might reach a real login page; it does not fill or skip a username, password, SSO, or 2FA gate. If a login form is already rendered and waiting for credentials, this branch is the wrong tool. Fingerprint, TLS, or canvas failure after the IP already looks residential is also out of scope. Further reading: Imperva Error 16, Access Denied, Grok Bot.

Branch D — Login wall vs IP-triggered login page

You may see a username and password form already on screen, with SSO or 2FA options; a soft "sign in to continue" page that appeared only after the datacenter IP hit the site, with no real app HTML yet; "We've temporarily limited your login"; a Shopify login completely blocked from the VM; or "Please log in" copy that sits on top of a block card rather than a working auth flow.

A normal login form needs authentication. A request refused before the login form appears may instead involve an IP or browser restriction. The URL and the presence of the word “login” do not distinguish these cases.

“We've temporarily limited your login” can be a rate or account-security restriction. Follow the service’s instructions first. A Shopify login refused from a VM also needs diagnosis; it is not proof of a datacenter-IP block. If shop staff provide an Admin API path, evaluate that supported option.

Use Aluvia only when the evidence supports an IP-related refusal. Inspect setup and reload. If a credential form appears, complete the normal authentication flow. Do not rotate to evade a login wait period or retry denied authentication.

Password, SSO, or 2FA problems with no IP story are out of scope, as is filling, skipping, or bypassing a login form that already rendered. Do not frame this as login bypass. Further reading: Unblock a page from a cloud VM, docs.

Branch E — None of the above, or mixed signals

Record the exact error and check which request failed. Do not rotate an IP just because the cause is unclear. Follow the site's instructions, including any wait period. If evidence points to an IP-related refusal, use the trial sequence below.

Honest limits

Compared with the usual operator workarounds

Quick map

Next step

If the site is reacting to the datacenter IP or the wrong country, start on the agent machine with npx aluvia-cli setup, then open https://aluvia.io.

Start a trial only for an eligible IP problem

Aluvia is a local CLI and proxy daemon for the existing browser. Run on its host with Node.js 18 or later and usable local Chrome or Chromium. Initial configuration can restart Chrome. First 10 MB free without an account, API key or payment; then 2 USD per GB.

Command
npx aluvia-cli setup

Inspect the setup result

Read JSON and follow next for recovery. ready: true confirms the proxy connection, not target access. Successful setup already enables the global pool. If the task needs a country, inspect current availability first.

Command
aluvia geos

Select a country only when needed

This example uses the United States. Use US only if the task needs it and it is listed; otherwise substitute the required available country. Skip selection if the global pool fits.

Command
aluvia proxy-on --geo US

Reload the page and check the result

Verify the content in the same browser, then inspect status. An upstream connection is not task success.

Command
aluvia status

If an IP-related block remains, try one rotation and reload. Stop if it still fails. Rate limits need waiting and fewer requests.

Command
aluvia rotate-ip

Return to the original IP

Use this when the task is finished or the IP change did not help. After setup, Chrome keeps running.

Command
aluvia proxy-off

When the trial ends

Show the actual claim_url from payment_required to the operator. They can claim the account and buy data at 2 USD per GB. Run aluvia auth login to wait, inspect the response and retry. Never invent a claim URL or reveal a key. Payment handoff.