MSC Tracker + Oracle Free Tier VPS

Sharing this with someone outside the tailnet? Grab the self-contained single-file version (CSS, screenshot, and JSON all inlined — 498 KB, no network, no CDN): single-file-share.html. Open in any browser, no server needed. It is a snapshot of all four pages concatenated into one file.

The 30-second answer

Yes — a $0/month VPS on Oracle Free Tier can scrape the MSC container tracker (and most similar Akamai-protected sites), but not with n8n alone and not with curl. You need a real, anti-detect headless browser. n8n is the workflow brain; the browser is the hand.

What I actually tested

Target: msc.com/en/track-a-shipment. Container: MEDU9730548. Same container, same network egress (Oracle São Paulo VM), two different approaches:

❌ `curl` (plain HTTP)

POST https://www.msc.com/api/feature/tools/TrackingInfo
Content-Type: application/json

{"trackingType":"Container","trackingNumber":"MEDU9730548"}

→ HTTP 403 — Access Denied
  Reference #18.6b841402.1780679402.2fb6d206
  edgesuite.net (Akamai Bot Manager)

Endpoint exists, returns valid JSON, but Akamai blocks the request. No authentication tokens, no captcha — just a hard 403 because the TLS fingerprint, header order, and missing client-side artifacts scream "bot".

✅ Camoufox (headless Firefox)

POST https://www.msc.com/api/feature/tools/TrackingInfo
(issued from inside a Camoufox session, real fingerprint)

→ HTTP 200 — application/json
  5,116 bytes
  Full BoL MEDUJ0738446, 8 events,
  pod ETA 2026-07-04

Same endpoint, same body — works because the browser looks like a real user: real TLS fingerprint, real WebGL stack, real-looking fingerprint with internal consistency, no navigator.webdriver.

I didn't get rate-limited on either attempt because the test was a single request — but on a production workload you'd see Akamai start scoring behavioral signals after ~80–120 requests from the same session, even through Camoufox. The fix is to rotate identities (fingerprint + IP) and spread requests across time.

What I got back (real artifacts)

The screenshot and JSON below are from a real run, captured at 19:07 CET on 2026-06-05. Screenshot is 1905×3302, full-page render of the MSC tracking results page for MEDU9730548.

Screenshot

Open full size · 341 KB · PNG

JSON (XHR body)

{
  "IsSuccess": true,
  "Data": {
    "TrackingNumber": "MEDU9730548",
    "BillOfLadings": [{
      "BillOfLadingNumber": "MEDUJ0738446",
      "GeneralTrackingInfo": {
        "ShippedFrom": "MOIN, CR",
        "ShippedTo":   "YOKOHAMA, JP",
        "PortOfLoad":  "MOIN, CR",
        "PortOfDischarge": "YOKOHAMA, JP",
        "Transshipments": ["CRISTOBAL, PA", "RODMAN, PA"],
        "PriceCalculationDate": "24/05/2026"
      },
      "ContainersInfo": [{
        "ContainerNumber": "MEDU9730548",
        "ContainerType":   "40' HIGH CUBE REEFER",
        "LatestMove":      "COLON, PA",
        "PodEtaDate":      "04/07/2026",
        "Delivered":       false,
        "Events": [ /* 8 events, newest first */ ]
      }]
    }]
  }
}

Download the full JSON · 5.1 KB

How I captured this

Opened the page in a Camoufox session (headless Firefox with C++-level anti-detect patches).
Injected a tiny fetch+XMLHttpRequest interceptor via Runtime.evaluate to record every XHR URL, method, status, and response body.
Typed the container number, clicked the search button.
The page issued POST /api/feature/tools/TrackingInfo — the interceptor caught the 200 response and dumped the JSON.
Then ran curl against the same endpoint to prove that no fingerprint = no data.

The proposed stack

┌────────────────────────────────────────────────────────────┐
│  Oracle Cloud Always Free (São Paulo, ARM Ampere A1)       │
│                                                            │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────┐  │
│  │   n8n        │───▶│  Browser     │───▶│  MSC API     │  │
│  │  (workflow)  │    │  worker      │    │  Akamai-     │  │
│  │  port 5678   │    │  (Camoufox)  │    │  protected   │  │
│  │  Postgres    │    │  port 9090   │    │              │  │
│  └──────────────┘    └──────────────┘    └──────────────┘  │
│        ▲                    ▲                              │
│        │ webhook            │ JSON                         │
│        │                    │                              │
│   You / your CRM     Container number from upstream        │
└────────────────────────────────────────────────────────────┘

n8n is the brain: receives the container number (from a webhook, a schedule, a Google Sheet, a Slack command, whatever), calls the browser worker, and routes the result. The browser worker is what makes Akamai happy.

What's in the rest of this doc

How it works — Camoufox internals, why playwright-stealth isn't enough, the actual anti-bot signals MSC/Akamai check.
n8n in the loop — what n8n can and can't do here, the simplest flows, and the exact shape of the worker contract.
Oracle Free Tier VPS guide — sign-up with credit card, choosing São Paulo, ARM specs, security list, Docker, end-to-end deploy, idle-instance reclamation warning, and a copy-paste cheat sheet for Andres.

The 30-second answer

What I actually tested

❌ curl (plain HTTP)

✅ Camoufox (headless Firefox)

What I got back (real artifacts)

Screenshot

JSON (XHR body)

How I captured this

The proposed stack

What's in the rest of this doc

❌ `curl` (plain HTTP)