Make Chrome's regional profile match your visible IP: geolocation, timezone, language, Accept-Language, and regional font signals.

GeoMirror is a Chrome Manifest V3 extension for people who use proxies, VPNs, remote desktops, or regional network exits and want the browser-visible environment to be internally consistent.

中文说明 · Privacy policy · Technical notes

Recent Claude / Anthropic account-ban controversies made one thing very clear: location-based risk controls can become brutal when they are applied mechanically. Many users reported that simply changing IPs, traveling, using VPNs, or having inconsistent regional signals could trigger account restrictions or bans. When a company such as Anthropic turns coarse address/location heuristics into account loss, the result is infuriating — but anger does not solve the operational problem.

The practical problem is this:

Most people only change their IP address. Their browser still exposes signals from somewhere else:

• navigator.geolocation may reveal the real physical location.
• Date.prototype.getTimezoneOffset() may reveal the local machine timezone.
• Intl.DateTimeFormat().resolvedOptions().timeZone may reveal the system timezone.
• navigator.language / navigator.languages may reveal the host language.
• the HTTP Accept-Language header may reveal another locale.

That mismatch is exactly the kind of thing automated risk systems can use as a proxy/VPN/fraud signal. GeoMirror exists to close that gap.

Test project:

• Live check: fuck-claude.vercel.app
• Source: LinXiaoTao/FuckClaude

Without GeoMirror	With GeoMirror

In this test environment, the estimate fell from 72/100 to 1/100. The system-timezone, browser-language, Chinese-font, Intl-locale, and UTC+8-offset signals stopped matching; only the weak Apple Emoji signal inferred from the user agent remained.

This is one result for a specific machine, Chrome version, exit IP, and detector version—not a guarantee about Claude or any platform's risk controls. The test project also states that only the OS-timezone signal directly corresponds to the public Claude Code reverse-engineering report; the other signals are correlation-based estimates.

GeoMirror detects your visible exit IP, derives a plausible browser profile from that IP, and applies it locally inside Chrome:

The goal is simple: if your IP looks like Tokyo, the browser should not still look like Shanghai, Los Angeles, or Berlin.

GeoMirror is local-first and auditable:

• No account.
• No telemetry.
• No analytics.
• No page-content reading.
• No remote configuration.
• Computed overrides and settings are stored in chrome.storage.local.

To match your current exit IP automatically, GeoMirror must call explicitly listed public IP/geolocation/map APIs through Chrome’s network stack. These requests are limited to:

• detecting the exit IP location,
• finding nearby residential roads,
• reverse-geocoding a display address for the popup.

It does not send page text, browsing history, cookies, credentials, form data, or scan results to the GeoMirror author. The project has no backend, account system, telemetry, or remote configuration. See PRIVACY.md and docs/TECHNICAL.md for the complete outbound-domain and field list.

“Zero network access” and “automatically follow the current public exit IP” cannot both be true: without consulting an IP information source, the extension cannot know which public exit websites see. GeoMirror keeps automatic matching and limits network access to auditable public providers.

Mature anti-detect browsers also match timezone/geolocation to a proxy IP and cover many more surfaces; see the official Multilogin fingerprint settings and GoLogin profile parameters. GeoMirror's distinction is not broader coverage. It avoids creating a separate browser identity and instead repairs the most obvious regional contradictions inside your existing Chrome.

“An anti-detect browser is itself a fingerprint” needs nuance: using one does not make detection inevitable, but any rare browser core, unusual API behavior, unstable parameters, or internal mismatch can increase distinguishability. A stable, coherent profile matters more than changing the maximum number of values.

   proxy / VPN / remote exit          Chrome + GeoMirror
              │                              │
              ▼                              ▼
        visible exit IP ───────► background service worker
                                      │
                 ┌────────────────────┼────────────────────┐
                 ▼                    ▼                    ▼
          IP geolocation      residential roads      reverse geocode
          + timezone          near exit IP            for popup display
                 │                    │                    │
                 └──────────────► computed override ◄──────┘
                                      │
                         stored in chrome.storage.local
                                      │
                    ┌─────────────────┴─────────────────┐
                    ▼                                   ▼
          isolated-world bridge              MAIN-world injector
          reads extension storage            patches page-visible APIs
                    │                                   │
                    └────────────► page sees a coherent browser profile

Technical sequence:

1. background.js detects the visible exit IP using multiple providers.
2. lib/providers.js normalizes IP geolocation data and preserves provider timezone fields such as Asia/Tokyo.
3. lib/geo.js chooses a nearby residential-looking coordinate using OpenStreetMap / Overpass.
4. lib/locale.js infers a plausible locale bundle from country code + timezone.
5. background.js stores the override locally and installs a dynamic Accept-Language header rule.
6. content-bridge.js runs in Chrome’s isolated extension world, reads local storage, and publishes the payload into a DOM attribute.
7. content-inject.js runs in the page’s MAIN world at document_start and patches the browser APIs before page scripts run.

1. Download or clone this repository.
2. Open chrome://extensions.
3. Enable Developer mode.
4. Click Load unpacked.
5. Select the geomirror folder.
6. Pin GeoMirror and click Refresh in the popup.

A store listing is planned. Until then, use the unpacked extension.

Open a fingerprint/location test page and check these values:

navigator.language
navigator.languages
Intl.DateTimeFormat().resolvedOptions()
new Date().getTimezoneOffset()
navigator.geolocation.getCurrentPosition(console.log, console.error)

Also check DevTools → Network → request headers and confirm Accept-Language matches the spoofed locale.

Useful public checks:

• Fuck Claude live check (source)
• https://browserleaks.com/geo
• https://browserleaks.com/javascript
• https://browserleaks.com/headers

• Location spoof — enable/disable geolocation override.
• Timezone spoof — enable/disable Date and Intl.DateTimeFormat timezone override.
• Language spoof — enable/disable navigator.language(s), Intl locale, and Accept-Language header override.
• Regional font mask — mask common Chinese system/vendor font probes for non-Chinese exit profiles.
• Reported accuracy (m) — reported GPS accuracy, default 30 m.
• Auto-refresh interval (minutes) — how often GeoMirror re-detects the exit IP.
• ipinfo.io token (optional) — improves fallback reliability if you have a token.

You can give the following prompt to your coding agent to audit or build a local version. It includes the provider-timezone, first-read race, and font-probe details that are easy to miss:

Build an auditable Chrome Manifest V3 extension that aligns region signals visible to ordinary web pages with the current public exit IP.

Requirements:
1. State the scope precisely: ordinary Chrome pages only. Do not claim to modify the OS, Claude Code, terminal networking, DNS, TLS, proxies, or server-side risk controls.
2. Detect the current public exit IP through Chrome's network stack with multiple IP-geolocation fallbacks. Prefer a result with a valid IANA timezone; if the first provider only has coordinates, continue instead of treating timezone:null as complete.
3. Preserve country code, city/region/country, coordinates, ISP, and IANA timezone. Infer navigator.language, navigator.languages, default Intl locale, and Accept-Language from country + timezone.
4. Prefer a nearby OpenStreetMap Overpass highway=residential point over the raw IP centroid, with a boundary-safe jitter fallback.
5. Use two content scripts:
   - an isolated-world bridge that can read chrome.storage and publish a JSON payload to the DOM;
   - a MAIN-world injector at document_start that patches page-visible APIs.
6. MAIN world cannot synchronously read chrome.storage. Install a neutral first-read guard while waiting for the bridge so inline scripts cannot read the host's Asia/Shanghai / UTC+8 first; replace it immediately when the exit profile arrives.
7. Patch:
   - navigator.geolocation.getCurrentPosition / watchPosition / clearWatch
   - navigator.permissions.query for geolocation
   - Date.prototype.getTimezoneOffset with DST-aware IANA timezone logic using the receiver Date instance
   - Intl.DateTimeFormat default timezone and resolvedOptions().timeZone
   - navigator.language and navigator.languages
   - Intl.DateTimeFormat / Intl.NumberFormat / Intl.Collator default locale
   - common Chinese system/vendor font probes through CanvasRenderingContext2D, OffscreenCanvas, FontFaceSet.check, and JS-assigned inline CSS; enable only for non-Chinese exit profiles
8. Set outgoing Accept-Language through chrome.declarativeNetRequest and expose independent location/timezone/language/font toggles.
9. Store settings and overrides only in chrome.storage.local. Never read page text, cookies, credentials, forms, or browsing history. Add no accounts, telemetry, analytics, remote config, or project backend.
10. Do not claim zero network access. List every host_permission, public provider purpose, sent field, and fallback order.
11. Test DST, Invalid Date, locale inference, provider timezone enrichment, timezone:null regression, font lists/rewriting, injection order, and synchronous first-read behavior.
12. Document uncovered surfaces separately: Web Workers, special iframes, Chrome privileged pages, and Claude Code / CLI.

• GeoMirror improves consistency. It is not a complete anti-fingerprinting system.
• IP geolocation is approximate.
• Locale inference is heuristic because IP providers do not know the real user language.
• Chrome extensions cannot inject into chrome://, the Chrome Web Store, or other privileged pages.
• The current implementation cannot change the system timezone or network environment seen by Claude Code or other native processes. CLI support remains on the roadmap.
• Web Workers, SharedWorkers, Service Workers, and special about:blank / srcdoc frames may still expose the host environment.
• Some platforms may use additional risk signals outside browser JavaScript and headers.

Project layout:

geomirror/
├── manifest.json
├── background.js
├── content-bridge.js
├── content-inject.js
├── docs/
│   └── TECHNICAL.md
├── lib/
│   ├── geo.js
│   ├── font-mask.js
│   ├── locale.js
│   ├── providers.js
│   └── timezone.js
├── popup.html
├── popup.css
├── popup.js
├── test/
│   ├── inject-smoke.js
│   └── run-tests.js
└── icons/

Checks:

node test/run-tests.js
node test/inject-smoke.js
node --check background.js
node --check content-inject.js
node --check content-bridge.js
node --check lib/providers.js
node --check lib/locale.js
node --check lib/timezone.js
node --check lib/font-mask.js
node --check popup.js

After changing files, reload the extension in chrome://extensions.

Pull requests welcome. Keep the permission surface minimal and preserve the no-telemetry, no-page-content-reading guarantees.

MIT