H5 block

[manziamigocyber]

Moviebox H5 blocks all the ip from VPS to other cloud services, anyone with a fix ?

[kunyitnipis]

I use Tencent Lighthouse. At first, it works, then video sources were blocked. Then ChatGPT successfully help me bypass it.

[manziamigocyber]

I use Tencent Lighthouse. At first, it works, then video sources were blocked. Then ChatGPT successfully help me bypass it.

How even, can we talk !

[kunyitnipis]

I use Tencent Lighthouse. At first, it works, then video sources were blocked. Then ChatGPT successfully help me bypass it.

How even, can we talk !

Sorry. It works only for days.

Sometimes it works again, but then it shows no result. it could time limit. I meant it can only get result once in every some time. Still struggling to solve it.

NOW, it works.

[ndizeyedavid]

Hi @kunyitnipis , I too am facing the same issue with the streaming endpoint being blocked because of the IP being geo-locked.

Care to share with us how to fix it🤲🙏

[user-app-devs]

Same here too facing too many requests

[user-app-devs]

Moviebox H5 blocks all the ip from VPS to other cloud services, anyone with a fix ?

Have you been able to fix it

[ndizeyedavid]

Hey guys! I was stuck on the exact same thing, VPS/AWS IPs getting geo-blocked. Here's how I got it working reliably.

The core problem: Moviebox H5 flags datacenter IPs. Your VPS IP gets burned, so no amount of retrying fixes it, you have to make the upstream think a normal residential browser made the request.

What fixed it for me (FastAPI + httpx proxy):

1. Forward the caller's real IP upstream. Take the real client IP (from X-Forwarded-For → X-Real-IP → socket peer) and pass it on every proxied request:

def _geo_headers(client_ip: str) -> dict:
    if not client_ip:
        return {}
    return {"X-Forwarded-For": client_ip, "X-Real-IP": client_ip}

The geo-lock then sees a legit client IP, never your VPS IP.

2. Fully impersonate a real Chrome browser. Bare requests.get() gets you flagged in 5 minutes. Send a modern Chrome UA plus sec-ch-ua, sec-fetch-dest/mode/site, Referer, Origin, Accept-Language, and X-Client-Info (timezone). This was the single biggest change.

3. Auto-refresh the guest token. The API returns a JWT in the x-user response header on first hit. Grab it, send Authorization: Bearer <token> on later calls, and refresh when you get 401s. Don't hardcode one token.

4. Different headers per domain. The player/stream domain wants sec-fetch-site: same-origin + its own Referer; the API wants cross-site. Same UA, different flavor.

Why "it works for days then stops": that's IP-based rate limiting, not a code bug. Once the CDN flags your VPS IP it's burned. Forwarding the caller's IP (step 1) keeps their IP in the line of fire instead of yours, and refreshing the token (step 3) stops you hammering with a stale one.

One caveat: you're effectively passing your user's IP to a third party, so be mindful of that (or substitute a residential-proxy IP instead).

Hope this helps, the header impersonation was doing 90% of the work for me.

You may also refer to how I edited the code in this commit: ndizeyedavid/mellow-movies@bc52764

PS. I still thank @walterwhite-69 for giving us this amazing API😊🙏

[user-app-devs]

Hey guys! I was stuck on the exact same thing, VPS/AWS IPs getting geo-blocked. Here's how I got it working reliably.

The core problem: Moviebox H5 flags datacenter IPs. Your VPS IP gets burned, so no amount of retrying fixes it, you have to make the upstream think a normal residential browser made the request.

What fixed it for me (FastAPI + httpx proxy):

1. Forward the caller's real IP upstream. Take the real client IP (from X-Forwarded-For → X-Real-IP → socket peer) and pass it on every proxied request:

def _geo_headers(client_ip: str) -> dict:
if not client_ip:
return {}
return {"X-Forwarded-For": client_ip, "X-Real-IP": client_ip}
The geo-lock then sees a legit client IP, never your VPS IP.

2. Fully impersonate a real Chrome browser. Bare requests.get() gets you flagged in 5 minutes. Send a modern Chrome UA plus sec-ch-ua, sec-fetch-dest/mode/site, Referer, Origin, Accept-Language, and X-Client-Info (timezone). This was the single biggest change.
3. Auto-refresh the guest token. The API returns a JWT in the x-user response header on first hit. Grab it, send Authorization: Bearer <token> on later calls, and refresh when you get 401s. Don't hardcode one token.
4. Different headers per domain. The player/stream domain wants sec-fetch-site: same-origin + its own Referer; the API wants cross-site. Same UA, different flavor.

Why "it works for days then stops": that's IP-based rate limiting, not a code bug. Once the CDN flags your VPS IP it's burned. Forwarding the caller's IP (step 1) keeps their IP in the line of fire instead of yours, and refreshing the token (step 3) stops you hammering with a stale one.

One caveat: you're effectively passing your user's IP to a third party, so be mindful of that (or substitute a residential-proxy IP instead).

Hope this helps, the header impersonation was doing 90% of the work for me.

You may also refer to how I edited the code in this commit: ndizeyedavid/mellow-movies@bc52764

PS. I still thank @walterwhite-69 for giving us this amazing API😊🙏

Can we use cloudflare

[user-app-devs]

Can I deploy in on cloudflare back after doing this or I use vps?

…

On Sat, Aug 8, 2026, 6:39 AM David Ndizeye ***@***.***> wrote: *ndizeyedavid* left a comment (walterwhite-69/Moviebox-API#4) <#4 (comment)> Hey guys! I was stuck on the exact same thing, VPS/AWS IPs getting geo-blocked. Here's how I got it working reliably. *The core problem:* Moviebox H5 flags datacenter IPs. Your VPS IP gets burned, so no amount of retrying fixes it, you have to make the upstream think a *normal residential browser* made the request. *What fixed it for me (FastAPI + httpx proxy):* 1. *Forward the caller's real IP upstream.* Take the real client IP (from X-Forwarded-For → X-Real-IP → socket peer) and pass it on every proxied request: def _geo_headers(client_ip: str) -> dict: if not client_ip: return {} return {"X-Forwarded-For": client_ip, "X-Real-IP": client_ip} The geo-lock then sees a legit client IP, never your VPS IP. 2. *Fully impersonate a real Chrome browser.* Bare requests.get() gets you flagged in 5 minutes. Send a modern Chrome UA plus sec-ch-ua, sec-fetch-dest/mode/site, Referer, Origin, Accept-Language, and X-Client-Info (timezone). This was the single biggest change. 3. *Auto-refresh the guest token.* The API returns a JWT in the x-user response header on first hit. Grab it, send Authorization: Bearer <token> on later calls, and refresh when you get 401s. Don't hardcode one token. 4. *Different headers per domain.* The player/stream domain wants sec-fetch-site: same-origin + its own Referer; the API wants cross-site. Same UA, different flavor. *Why "it works for days then stops":* that's IP-based rate limiting, not a code bug. Once the CDN flags your VPS IP it's burned. Forwarding the caller's IP (step 1) keeps *their* IP in the line of fire instead of yours, and refreshing the token (step 3) stops you hammering with a stale one. *One caveat:* you're effectively passing your user's IP to a third party, so be mindful of that (or substitute a residential-proxy IP instead). Hope this helps, the header impersonation was doing 90% of the work for me. — Reply to this email directly, view it on GitHub <#4?email_source=notifications&email_token=BU32VL7UMUHM4VDSZ7QVUBT5I24HRA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRSGQ3TMNBQGE32M4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5224764017>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BU32VL2VOXQILBA6YA2VKMD5I24HRAVCNFSNUABGKJSXA33TNF2G64TZHMYTCNRXGI3DSMJQGU5US43TOVSTWNBZGAYTSNRYGY2DPILWAI> . You are receiving this because you commented.Message ID: ***@***.***>

[ndizeyedavid]

yeah, you sure can. I have deployed that backend on a free instance of fastapicloud.com. I have also tested it on Render and it too works. So cloudflare and any other hosting provider or VPS could work too

[user-app-devs]

Please Can you drop your WhatsApp contacts so you could guide me pls I tried to deploy Nuxtjs way on cloudflare but failed.

…

On Sat, Aug 8, 2026, 3:51 PM David Ndizeye ***@***.***> wrote: *ndizeyedavid* left a comment (walterwhite-69/Moviebox-API#4) <#4 (comment)> yeah, you sure can. I have deployed that backend on a free instance of fastapicloud.com. I have also tested it on Render and it too works. So cloudflare and any other hosting provider or VPS could work too — Reply to this email directly, view it on GitHub <#4?email_source=notifications&email_token=BU32VL7SRTLWB7IP6VG272T5I45AZA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRSGY3DENRTGY2KM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5226626364>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BU32VLYZN74OY4XT6SEYMO35I45AZAVCNFSNUABGKJSXA33TNF2G64TZHMYTCNRXGI3DSMJQGU5US43TOVSTWNBZGAYTSNRYGY2DPILWAI> . You are receiving this because you commented.Message ID: ***@***.***>

[ndizeyedavid]

Please Can you drop your WhatsApp contacts so you could guide me pls I
tried to deploy Nuxtjs way on cloudflare but failed.
…

Hi @user-app-devs , Unfortunately i cannot provide my WA contact publicly here, but worry not, I've received your email and I am going to schedule a 1:1 meeting(via google meet) with you on Monday in the evening(7:00PM CAT). If the time is not working well with your schedule, you are free to reschedule the meet to another time that is more convenient for you but in the evening.

Thank you😊🙏

[user-app-devs]

Alright no problem can we chat at personal email

…

On Sat, Aug 8, 2026, 6:28 PM David Ndizeye ***@***.***> wrote: *ndizeyedavid* left a comment (walterwhite-69/Moviebox-API#4) <#4 (comment)> Please Can you drop your WhatsApp contacts so you could guide me pls I tried to deploy Nuxtjs way on cloudflare but failed. … <#m_4838901004566023753_> Hi @user-app-devs <https://github.com/user-app-devs> , Unfortunately i cannot provide my WA contact publicly here, but worry not, I've received your email and I am going to schedule a 1:1 meeting(via *google meet*) with you on Monday in the evening(7:00PM CAT). If the time is not working well with your schedule, you are free to reschedule the meet to another time that is more convenient for you but in the evening. Thank you😊🙏 — Reply to this email directly, view it on GitHub <#4?email_source=notifications&email_token=BU32VL7ZJ2A57E7SPWZR6JT5I5PL3A5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRSG4ZDONBVHE42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5227274599>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BU32VL4QWXOWVGIYCBXHDI35I5PL3AVCNFSNUABGKJSXA33TNF2G64TZHMYTCNRXGI3DSMJQGU5US43TOVSTWNBZGAYTSNRYGY2DPILWAI> . You are receiving this because you were mentioned.Message ID: ***@***.***>