# Is it geo, Cloudflare, Imperva, or a login wall?

Match the string on the screen to geo, Cloudflare, Imperva Error 16, or a login-shaped page, then run the commands that belong to that branch.

A decision tree for operators whose Grok Bot or other cloud agent runs Chrome on a US AWS (or similar) datacenter IP and then stalls on a challenge, a block card, a region message, or a page that looks like login. Match the string on the screen to a branch. Each branch says what the site is doing, when a residential or mobile exit helps, when it does not, and the exact commands to try.

## The command

```sh
npx aluvia-cli setup
```

Read the screen. Then pick the branch that matches. Replace country codes from `aluvia geos`. First 10 MB is free, with no account and no API key. Then $2/GB.

## Before you branch

Grok Bot and many cloud agents run on a cloud VM. Every tab carries that machine's address. Sites treat that address as the agent's country and as a risk signal. Operators often try a Tailscale home exit (it wipes when the instance is replaced), take over the computer by hand, or hope a region picker appears. Those paths are real. They are also either attended or fragile.

Aluvia is a local CLI on the same VM. The agent installs it, picks a country when needed, and sends the existing Chrome through a residential or mobile IP. Sticky sessions last up to 30 minutes. Aluvia is not a human VPN, not for streaming or live video, not an MCP, and not a login bypass. Country only, not city. It does not change fingerprint, Linux Chrome, TLS, or canvas. A residential or mobile IP sometimes clears a 403, CAPTCHA, Cloudflare challenge, or Imperva Error 16. Sometimes. Not a promise.

```sh
npx aluvia-cli setup
aluvia geos
aluvia proxy-on --geo US
```

## Branch A — Wrong country / geo not available

Strings you may see include "Not available in your region," "This content is not available in your country," "We don't ship to your location," a catalog, currency, language, or tax line that matches the datacenter country instead of the market you need, or a storefront that never offers the region you expected, with no Ray ID and no Imperva incident card.

The site is reading the client IP and choosing the country page from that address. On a US cloud VM, UK and EU shops often return US prices or say the content is not available. The miss is geolocation, not a human-check widget.

This is the primary use case. Pick the country the page needs and reload. The site should see a residential or mobile IP in that country and serve that country's page. Use `GB` for a UK catalog from a US VM. Use `NZ`, `DE`, or another code when that is the market. Confirm with `aluvia geos`. Keep the session sticky for up to 30 minutes when you need the same exit through browse and checkout.

Aluvia does not help for streaming or live video, for city / GPS / timezone / Accept-Language spoofing, or for a content licence that forbids the region regardless of IP. Further reading: [`/unblock/geo-restricted`](/unblock/geo-restricted), [`/geo`](/geo), [`/geo/grok-bot`](/geo/grok-bot).

```sh
npx aluvia-cli setup
aluvia geos
aluvia proxy-on --geo GB
```

## Branch B — Cloudflare challenge or CAPTCHA that returns

Strings you may see include "Verify you are human," "Checking if the site connection is secure," "Please verify you are a human," "Sorry, you have been blocked," Error 1020, Error 1015, a CAPTCHA that comes back after every solve, or a Ray ID in the page footer.

Cloudflare (or a similar edge) scores the connection before the origin HTML. A cloud or datacenter IP is a large part of that score. The challenge can repeat on every request from the VM even after a human solve. A Ray ID means the edge decided; it does not mean the next load will pass.

A residential or mobile exit is one input to that score. It sometimes lets the page through. Turn the proxy on, reload, and if the same exit is still blocked, rotate. Add `--geo XX` when the page also needs a specific country.

Aluvia does not help if the page already names fingerprint, Linux Chrome, TLS, or canvas as the failure and the IP already looks residential, if you need a guarantee that every Cloudflare challenge clears, or if a normal login form is already on screen waiting for credentials or 2FA. Further reading: [`/unblock/cloudflare`](/unblock/cloudflare), [`/unblock/captcha`](/unblock/captcha), [`/unblock/403`](/unblock/403), [`/unblock/unusual-traffic`](/unblock/unusual-traffic), [`/unblock/rate-limit`](/unblock/rate-limit).

```sh
npx aluvia-cli setup
aluvia proxy-on
aluvia rotate-ip
```

## Branch C — Imperva Error 16 / security service block

Strings you may see include "Error 16," "This request was blocked by our security service," "Access denied" on a card that also says Imperva, "Your IP" / "Proxy IP" / "Incident ID," "Powered by imperva," or hostnames that still show on the card while the rest of the site is missing. Trade shops are a common shape.

Imperva sits in front of the origin. Error 16 is its card: the security service classified the client and refused the request before application HTML came back. This is not a 403 from the origin and not a Cloudflare Ray ID flow. Cloud and hosting ranges are a common reason the service drops a visitor. A US cloud VM reaching a New Zealand trade site is that shape: datacenter IP, often the wrong country for the shop.

A residential or mobile exit sometimes reaches the origin. Sometimes. Turn the proxy on (with a country code if the shop expects one), reload, and rotate if the current exit is still dropped.

The address bar can show `/login` while the card is still Imperva's security service, not a credential form. Aluvia changes the exit IP so the request might reach a real login page; it does not fill or skip a username, password, SSO, or 2FA gate. If a login form is already rendered and waiting for credentials, this branch is the wrong tool. Fingerprint, TLS, or canvas failure after the IP already looks residential is also out of scope. Further reading: [`/unblock/imperva-security-service`](/unblock/imperva-security-service), [`/unblock/access-denied`](/unblock/access-denied), [`/geo/grok-bot`](/geo/grok-bot).

```sh
npx aluvia-cli setup
aluvia proxy-on --geo NZ
aluvia rotate-ip
```

## Branch D — Login wall vs IP-triggered login page

You may see a username and password form already on screen, with SSO or 2FA options; a soft "sign in to continue" page that appeared only after the datacenter IP hit the site, with no real app HTML yet; or "Please log in" copy that sits on top of a block card rather than a working auth flow.

Two different things get called login. A normal login wall is an auth form the operator or agent must complete; changing IP does not finish that form. An IP-triggered login or soft block is a login-shaped page (or a bounce to `/login`) when the client IP looks like cloud or hosting. No usable session starts until the address changes. The barrier is the IP classification, not missing passwords.

Aluvia helps only the second shape. Changing to a residential or mobile IP is the job. After the proxy is on, reload. If a real credential form then appears, that form is out of scope for Aluvia; the IP change only got you to it. Add `--geo XX` when country also matters. Use `aluvia rotate-ip` if the first exit still triggers the soft page.

Password, SSO, or 2FA problems with no IP story are out of scope, as is filling, skipping, or bypassing a login form that already rendered. Do not frame this as login bypass. Further reading: [`/unblock`](/unblock), [`/docs`](/docs).

```sh
npx aluvia-cli setup
aluvia proxy-on
```

## Branch E — None of the above, or mixed signals

Copy the exact error string, and a Ray ID or Incident ID if present. Check whether the page needs a different country even if a challenge is also showing. Geo and edge blocks often stack on a US VM opening a foreign shop. Run setup once on the machine, then `proxy-on` with the country code if you know it. Reload. If still blocked, `rotate-ip` once or twice. If the page still fails and names fingerprint, Linux Chrome, TLS, or canvas, stop treating IP as the only lever.

```sh
npx aluvia-cli setup
aluvia geos
aluvia proxy-on --geo XX
aluvia rotate-ip
aluvia proxy-off
```

## Honest limits

- Country only, not city.
- Residential or mobile IP egress. Not a human VPN. Not streaming.
- Not MCP. Not login bypass.
- Does not beat fingerprint, Linux Chrome, TLS, or canvas.
- Unblock outcomes are sometimes, never guaranteed.
- First 10 MB free (no account, no API key), then $2/GB.
- Docs live at [https://aluvia.io/docs](https://aluvia.io/docs).

## Compared with the usual operator workarounds

- Take over the computer: not unattended. It does not select a country.
- Tailscale home exit: mostly unattended. It does not survive instance replace. Country select only if home is in that country.
- Hope for region select: only if the site offers it.
- Aluvia: unattended. Survives replace by re-running setup on the new machine. Country select is `--geo`.

## Quick map

- Region / catalog / ship-to miss — Branch A. After setup, `aluvia proxy-on --geo XX`.
- Verify you are human / Ray ID / looping CAPTCHA — Branch B. `aluvia proxy-on`, then maybe `rotate-ip`.
- Error 16 / Imperva security service — Branch C. `aluvia proxy-on` (add `--geo` if needed).
- Login-shaped page with no credentials yet — Branch D. `aluvia proxy-on` if IP-triggered; stop if the form already needs secrets.
- Mixed or unclear — Branch E. Match strings, then proxy-on and rotate.

## Next step

If the site is reacting to the datacenter IP or the wrong country, start on the agent machine with `npx aluvia-cli setup`, then open [https://aluvia.io](https://aluvia.io).

---

Source: https://aluvia.io/resources/triage-geo-cloudflare-imperva