# Unattended browser on a datacenter IP Five short lessons for operators whose Grok Bot or cloud agent runs Chrome on a US datacenter IP and must keep working without a human in the seat. Each day ends with one action. The material reuses the triage branches and UK/NZ field scenarios. No invented case studies or customer counts. Facts that stay true all week: `npx aluvia-cli setup`; `aluvia proxy-on` / `--geo XX` / `rotate-ip` / `proxy-off`; `aluvia geos`; 10 MB free with no account and no API key, then $2/GB; country only; residential or mobile IP; sometimes clears 403 / CAPTCHA / Cloudflare / Imperva; does not beat fingerprint / Linux Chrome / TLS / canvas; not a VPN; not streaming; not MCP; not login bypass (an IP-triggered login page is in scope as change IP). Docs live at [https://aluvia.io/docs](https://aluvia.io/docs). ## The command ```sh npx aluvia-cli setup ``` Start on the agent machine. Product home: [https://aluvia.io](https://aluvia.io). ## Day 1 — Geo: the site is choosing the datacenter's country Grok Bot on a US VM presents a US address to every site it opens. That is enough for a UK or EU shop to return US prices, a US catalog, and US language, or to say the content is not available in your region. The same miss shows up as "we don't ship to your location," a tax line that belongs to the wrong market, or a storefront that never offers the region you expected. There may be no Cloudflare widget and no Imperva card. The page is simply reading the client IP and choosing the country from it. This is Aluvia's primary job. The agent installs a local CLI on the same VM, picks a country, and sends the existing Chrome through a residential or mobile IP in that country. The site then serves that country's page. The product is country only — not city, not GPS, not timezone, not Accept-Language spoofing. Omit `--geo` only when any exit in the global pool is enough; for catalog and checkout work, set the country explicitly. `GB` is the usual example when a US VM needs Britain. Replace it with the code for the market you actually need; `aluvia geos` lists what is available. Sticky sessions last up to 30 minutes. Keep the same exit through browse, cart, and checkout so the shop does not see the country flip mid-flow. Leave streaming and live video alone. A content licence that forbids the region regardless of IP is outside this tool. If the screen is a challenge or Error 16 rather than a region string, use Day 2 or Day 3 instead of forcing a geo-only story. Further reading: [`/geo/grok-bot`](/geo/grok-bot) and [`/unblock/geo-restricted`](/unblock/geo-restricted). Today's action: on the agent machine, run `npx aluvia-cli setup`, then `aluvia geos`, and write down the country code for the market you actually need. ```sh npx aluvia-cli setup aluvia geos aluvia proxy-on --geo GB ``` ## Day 2 — Cloudflare and CAPTCHA: sometimes the exit is enough Cloudflare scores the connection before origin HTML is served. Strings you may see include "Verify you are human," "Checking if the site connection is secure," "Please verify you are a human," "Sorry, you have been blocked," Error 1020, Error 1015, or a CAPTCHA that returns after every solve. A Ray ID in the page footer means the edge decided; it does not mean the next load will pass. A cloud or datacenter IP is a large part of that score. Operators often clear the challenge by hand (take over the computer) or route the VM through a Tailscale home exit. Both can work once. Hand clearance fails for unattended runs. A home exit can wipe when the cloud instance is replaced. Aluvia changes one input: the exit IP. A residential or mobile address sometimes lets the page through. Sometimes. Not a promise. Linux Chrome, TLS, canvas, and fingerprint can still fail after the address looks residential. Do not write or imply a guaranteed Cloudflare pass. Reload the page after `proxy-on`. If the same exit is still challenged, run `aluvia rotate-ip`. Add `--geo XX` when the page also needs a specific country (geo and edge blocks often stack on a US VM opening a foreign shop). Do not use Aluvia for a normal login wall that already needs credentials, SSO, or 2FA. An IP-triggered soft page that only appeared because the client looked like cloud hosting is change-IP territory; a form waiting for secrets is not. Further reading: [`/unblock/cloudflare`](/unblock/cloudflare) and [`/unblock/captcha`](/unblock/captcha). Today's action: capture the exact challenge string (and Ray ID if present) from one failing page, then try `aluvia proxy-on` and one `rotate-ip` if needed. Record whether the page loaded, still challenged, or failed for a non-IP reason. ```sh npx aluvia-cli setup aluvia proxy-on aluvia rotate-ip ``` ## Day 3 — Imperva Error 16: not Cloudflare, not a 403 from origin Imperva sits in front of some trade and retail origins. Error 16 is its card. You may see "This request was blocked by our security service," "Access denied," "Your IP," "Proxy IP," "Incident ID," or "Powered by imperva." The hostname can remain on the card while the catalog never loads. This is not a Cloudflare Ray ID flow and not a 403 returned by the application server after HTML started. A US cloud VM opening a New Zealand trade site is a common shape. The security service classified a datacenter client, often in the wrong country for the merchant. A residential or mobile exit sometimes reaches the origin. Hedge that sentence every time you say it aloud or in a runbook. Reload after `proxy-on --geo NZ`. If Error 16 returns, run `aluvia rotate-ip` and reload again. One exit can be blocked on its own; rotation is the next lever, not a second Chrome. Once a residential exit clears the card, stay inside the sticky window (up to 30 minutes) for search, cart, or account steps so you do not jump onto a new blocked address mid-flow. Watch the login false friend. The address bar can show `/login` while the card is still Imperva's security service. Changing the exit IP is in scope so a real login form might appear. Filling or skipping username, password, SSO, or 2FA is out of scope. If a credential form is already on screen and waiting, stop — that is a normal login wall, and Aluvia is the wrong tool. Further reading: [`/unblock/imperva-security-service`](/unblock/imperva-security-service) and [`/geo/grok-bot`](/geo/grok-bot). Today's action: if you have an Imperva-backed URL in your workflow, run `proxy-on` with the right `--geo`, reload once, rotate once if needed, and write the outcome in one sentence (cleared / still Error 16 / reached login form / non-IP failure). ```sh npx aluvia-cli setup aluvia proxy-on --geo NZ ``` ## Day 4 — Tailscale wipe vs Aluvia vs taking over the computer Three responses show up whenever an unattended agent hits a datacenter block. Name which one you are actually running before you add another dependency. Take over the computer: you clear "Verify you are human" yourself, or you finish the job in your own browser. xAI-style advice often lands here for a stuck session. It works for debugging. It fails as a workflow the moment the agent must run alone. Every future challenge becomes a page for you. Tailscale (or similar) with a home exit: install a mesh on the Grok Bot machine, put an always-on home Mac or mini up as an exit node, and send Chrome through the house residential IP. That can clear datacenter-triggered challenges and some login soft-blocks keyed on cloud ranges. The failure mode is the instance. When the cloud computer is replaced or reset, the Tailscale path is gone until someone rebuilds it. Country select only works if the home is already in that country. You are operating a VPN mesh so an agent can browse. Aluvia on the agent machine: local CLI, agent-run commands, country via `--geo`, re-run `npx aluvia-cli setup` after replace. Unblock remains sometimes. It survives wipe by being installable again in one command rather than by depending on a home box that stayed online. Aluvia is not a human VPN product and not for streaming. It is egress for the agent's existing Chrome. Prefer `aluvia proxy-off` when you want the machine IP again without stopping the browser. Take over the computer is not unattended and does not select a country. A Tailscale home exit is mostly unattended, with wipe risk on replace, and country select only if home is in that country. Aluvia is unattended, survives replace by re-running setup, and selects country with `--geo`. Today's action: write which of the three approaches you use today for unattended runs, and whether it survives the next instance replace without a human rebuild. ## Day 5 — Setup, trial, and claim_url Put the week into one machine path the agent can repeat after every replace. Replace `XX` with the country from Day 1. If `aluvia` is not on PATH, prefix every command with `npx aluvia-cli`. Every command prints JSON on stdout with a `next` field — read `next` and run it. Never print API keys. One Chrome restart is expected at setup; do not launch a second Chrome afterward. First 10 MB is free from an install id on the machine. No account and no API key to start. Then $2/GB on the Aluvia network. When the trial is used up, a command that needs the network returns `code: payment_required` and a `claim_url` on `dashboard.aluvia.io`. The operator opens that URL on their own machine, claims the account, and buys data. The agent then runs `aluvia auth login`. The agent cannot fix payment alone. Show `claim_url`. Never invent a key or paste secrets into chat. Bring-your-own proxy is available with `aluvia proxy-provider ` and is free for bandwidth on Aluvia's side; switch back with `aluvia proxy-provider aluvia`. Reminders that still apply on Day 5: country only; residential or mobile; sometimes for Cloudflare / CAPTCHA / Imperva; no fingerprint / TLS / canvas claims; not streaming; not MCP; not login bypass; docs at [https://aluvia.io/docs](https://aluvia.io/docs). If the page still fails after a residential exit and names fingerprint, Linux Chrome, TLS, or canvas, stop treating IP as the only lever and escalate with the exact error string instead of rotating forever. Start page: [https://aluvia.io](https://aluvia.io). Geo walkthrough: [`/geo/grok-bot`](/geo/grok-bot). Imperva card: [`/unblock/imperva-security-service`](/unblock/imperva-security-service). Payment handover: [`/e/payment_required`](/e/payment_required). Today's action: run `npx aluvia-cli setup` on the agent VM (or confirm it is already installed), complete one real page load through `proxy-on --geo XX`, and if you hit `payment_required`, open the `claim_url` yourself rather than pasting secrets into chat. ```sh npx aluvia-cli setup aluvia geos aluvia proxy-on --geo XX aluvia status aluvia rotate-ip aluvia proxy-off ``` ## After the five days You should be able to match a screen to geo, Cloudflare/CAPTCHA, Imperva, or an IP-triggered login-shaped block; choose Tailscale rebuild vs Aluvia re-setup consciously; and finish a trial path without guessing the price or the docs host. Run `npx aluvia-cli setup`, then open [https://aluvia.io](https://aluvia.io). --- Source: https://aluvia.io/resources/unattended-browser-course