[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92498":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":9,"pushedAt":9,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},92498,"geomirror","Azurboy\u002Fgeomirror","Azurboy","Mirror your visible IP's geolocation into the browser's HTML5 location API — automatically picks a nearby residential street. Chrome MV3.",null,"JavaScript",72,15,1,0,9,44.51,"MIT License",false,"main",true,[],"2026-07-22 04:02:06","# GeoMirror\n\n> Make Chrome's regional profile match your visible IP: geolocation, timezone, language, `Accept-Language`, and regional font signals.\n\nGeoMirror is a Chrome Manifest V3 extension for people who use proxies, VPNs, remote desktops, or regional network exits and want the browser-visible environment to be internally consistent.\n\n[中文说明](.\u002FREADME.zh-CN.md) · [Privacy policy](.\u002FPRIVACY.md) · [Technical notes](.\u002Fdocs\u002FTECHNICAL.md)\n\n> [!IMPORTANT]\n> GeoMirror currently changes **browser-side signals exposed to ordinary pages in Chrome**. It does not change macOS \u002F Windows settings, the Claude Code process, terminal traffic, `ANTHROPIC_BASE_URL`, DNS, TLS, or your proxy route. Claude Code \u002F CLI network-environment support is still on the roadmap.\n\n---\n\n## Motivation: IP alone is not enough\n\nRecent Claude \u002F Anthropic account-ban controversies made one thing very clear: location-based risk controls can become brutal when they are applied mechanically. Many users reported that simply changing IPs, traveling, using VPNs, or having inconsistent regional signals could trigger account restrictions or bans. When a company such as Anthropic turns coarse address\u002Flocation heuristics into account loss, the result is infuriating — but anger does not solve the operational problem.\n\nThe practical problem is this:\n\nMost people only change their **IP address**. Their browser still exposes signals from somewhere else:\n\n- `navigator.geolocation` may reveal the real physical location.\n- `Date.prototype.getTimezoneOffset()` may reveal the local machine timezone.\n- `Intl.DateTimeFormat().resolvedOptions().timeZone` may reveal the system timezone.\n- `navigator.language` \u002F `navigator.languages` may reveal the host language.\n- the HTTP `Accept-Language` header may reveal another locale.\n\nThat mismatch is exactly the kind of thing automated risk systems can use as a proxy\u002FVPN\u002Ffraud signal. GeoMirror exists to close that gap.\n\n## Measured browser-side result: 72 → 1\n\nTest project:\n\n- Live check: [fuck-claude.vercel.app](https:\u002F\u002Ffuck-claude.vercel.app\u002F)\n- Source: [LinXiaoTao\u002FFuckClaude](https:\u002F\u002Fgithub.com\u002FLinXiaoTao\u002FFuckClaude)\n\n| Without GeoMirror | With GeoMirror |\n| --- | --- |\n| ![Browser-region fingerprint risk score of 72 without GeoMirror](.\u002Fdocs\u002Fimages\u002Ffuck-claude-before-summary.png) | ![Browser-region fingerprint risk score of 1 with GeoMirror](.\u002Fdocs\u002Fimages\u002Ffuck-claude-after-summary.png) |\n| ![Timezone, language, font and Intl signals detected without GeoMirror](.\u002Fdocs\u002Fimages\u002Ffuck-claude-before-signals.png) | ![Timezone, language, font and Intl signals cleared with GeoMirror](.\u002Fdocs\u002Fimages\u002Ffuck-claude-after-signals.png) |\n\nIn this test environment, the estimate fell from **72\u002F100** to **1\u002F100**. The system-timezone, browser-language, Chinese-font, Intl-locale, and UTC+8-offset signals stopped matching; only the weak Apple Emoji signal inferred from the user agent remained.\n\nThis is one result for a specific machine, Chrome version, exit IP, and detector version—not a guarantee about Claude or any platform's risk controls. The test project also states that only the OS-timezone signal directly corresponds to the public Claude Code reverse-engineering report; the other signals are correlation-based estimates.\n\n## What GeoMirror does\n\nGeoMirror detects your visible **exit IP**, derives a plausible browser profile from that IP, and applies it locally inside Chrome:\n\n| Surface | What GeoMirror changes |\n| --- | --- |\n| HTML5 geolocation | Spoofs `navigator.geolocation` to a residential-looking coordinate near the exit IP. |\n| Geolocation permission | Reports geolocation permission as `granted` to avoid permission-state mismatch. |\n| Timezone offset | Spoofs `Date.prototype.getTimezoneOffset()` with DST-aware IANA timezone logic. |\n| Intl timezone | Spoofs default `Intl.DateTimeFormat` timezone and `resolvedOptions().timeZone`. |\n| Browser language | Spoofs `navigator.language` and `navigator.languages`. |\n| Intl locale | Spoofs default locale for `Intl.DateTimeFormat`, `Intl.NumberFormat`, and `Intl.Collator`. |\n| Request language | Sets outgoing `Accept-Language` via Chrome `declarativeNetRequest`. |\n| Regional fonts | Masks common Chinese system\u002Fvendor font probes when the exit profile is non-Chinese. |\n\nThe goal is simple: if your IP looks like Tokyo, the browser should not still look like Shanghai, Los Angeles, or Berlin.\n\n## Privacy model\n\nGeoMirror is local-first and auditable:\n\n- No account.\n- No telemetry.\n- No analytics.\n- No page-content reading.\n- No remote configuration.\n- Computed overrides and settings are stored in `chrome.storage.local`.\n\n### Network boundary: no project backend, but not zero-network\n\nTo match your current exit IP automatically, GeoMirror must call explicitly listed public IP\u002Fgeolocation\u002Fmap APIs through Chrome’s network stack. These requests are limited to:\n\n- detecting the exit IP location,\n- finding nearby residential roads,\n- reverse-geocoding a display address for the popup.\n\nIt does not send page text, browsing history, cookies, credentials, form data, or scan results to the GeoMirror author. The project has no backend, account system, telemetry, or remote configuration. See [PRIVACY.md](.\u002FPRIVACY.md) and [docs\u002FTECHNICAL.md](.\u002Fdocs\u002FTECHNICAL.md) for the complete outbound-domain and field list.\n\n“Zero network access” and “automatically follow the current public exit IP” cannot both be true: without consulting an IP information source, the extension cannot know which public exit websites see. GeoMirror keeps automatic matching and limits network access to auditable public providers.\n\n## Comparison with adjacent tools\n\n| Approach | Strengths | Costs \u002F risks | Best fit |\n| --- | --- | --- | --- |\n| GeoMirror | Uses your existing Chrome; automatically updates location, timezone, language, and font policy from the current exit IP; open-source and lightweight | Covers a focused set of Chrome page-level regional signals, not the complete fingerprint surface | One everyday browser, VPN\u002Fproxy switching, reducing obvious regional contradictions |\n| Anti-detect browsers (Multilogin, GoLogin, AdsPower, etc.) | Isolated profiles\u002Fcookies, proxy binding, broader control over Canvas, WebGL, WebRTC, hardware parameters, and automation | Separate browser\u002Fcore and profile management, often paid; unusual cores, extensions, automation behavior, or internally inconsistent settings also become part of the observable surface | Multi-account isolation, teams, automation, and full profile management |\n| Single-purpose timezone\u002Flanguage extensions | Small and simple | Usually manual; easy to forget after changing exits, and does not coordinate geolocation, fonts, locale, and request headers | Fixed regions and one-signal changes |\n| OS settings \u002F launch flags | Can affect Chrome and some local programs | Global side effects and higher switching cost; language, fonts, location, and the network exit still need separate handling | Fixed work environments or local CLI coverage |\n\nMature anti-detect browsers also match timezone\u002Fgeolocation to a proxy IP and cover many more surfaces; see the official [Multilogin fingerprint settings](https:\u002F\u002Fmultilogin.com\u002Fhelp\u002Fen_US\u002Fprofile-settings-fingerprint-section) and [GoLogin profile parameters](https:\u002F\u002Fgologin.com\u002Fdocs\u002Fprofile-parameters). GeoMirror's distinction is not broader coverage. It avoids creating a separate browser identity and instead repairs the most obvious regional contradictions inside your existing Chrome.\n\n“An anti-detect browser is itself a fingerprint” needs nuance: using one does not make detection inevitable, but any rare browser core, unusual API behavior, unstable parameters, or internal mismatch can increase distinguishability. A stable, coherent profile matters more than changing the maximum number of values.\n\n## How it works\n\n```\n   proxy \u002F VPN \u002F remote exit          Chrome + GeoMirror\n              │                              │\n              ▼                              ▼\n        visible exit IP ───────► background service worker\n                                      │\n                 ┌────────────────────┼────────────────────┐\n                 ▼                    ▼                    ▼\n          IP geolocation      residential roads      reverse geocode\n          + timezone          near exit IP            for popup display\n                 │                    │                    │\n                 └──────────────► computed override ◄──────┘\n                                      │\n                         stored in chrome.storage.local\n                                      │\n                    ┌─────────────────┴─────────────────┐\n                    ▼                                   ▼\n          isolated-world bridge              MAIN-world injector\n          reads extension storage            patches page-visible APIs\n                    │                                   │\n                    └────────────► page sees a coherent browser profile\n```\n\nTechnical sequence:\n\n1. `background.js` detects the visible exit IP using multiple providers.\n2. `lib\u002Fproviders.js` normalizes IP geolocation data and preserves provider timezone fields such as `Asia\u002FTokyo`.\n3. `lib\u002Fgeo.js` chooses a nearby residential-looking coordinate using OpenStreetMap \u002F Overpass.\n4. `lib\u002Flocale.js` infers a plausible locale bundle from country code + timezone.\n5. `background.js` stores the override locally and installs a dynamic `Accept-Language` header rule.\n6. `content-bridge.js` runs in Chrome’s isolated extension world, reads local storage, and publishes the payload into a DOM attribute.\n7. `content-inject.js` runs in the page’s MAIN world at `document_start` and patches the browser APIs before page scripts run.\n\n## Install\n\n### Option A — load unpacked\n\n1. Download or clone this repository.\n2. Open `chrome:\u002F\u002Fextensions`.\n3. Enable **Developer mode**.\n4. Click **Load unpacked**.\n5. Select the `geomirror` folder.\n6. Pin GeoMirror and click **Refresh** in the popup.\n\n### Option B — Chrome Web Store\n\nA store listing is planned. Until then, use the unpacked extension.\n\n## Verify it works\n\nOpen a fingerprint\u002Flocation test page and check these values:\n\n```js\nnavigator.language\nnavigator.languages\nIntl.DateTimeFormat().resolvedOptions()\nnew Date().getTimezoneOffset()\nnavigator.geolocation.getCurrentPosition(console.log, console.error)\n```\n\nAlso check DevTools → Network → request headers and confirm `Accept-Language` matches the spoofed locale.\n\nUseful public checks:\n\n- [Fuck Claude live check](https:\u002F\u002Ffuck-claude.vercel.app\u002F) ([source](https:\u002F\u002Fgithub.com\u002FLinXiaoTao\u002FFuckClaude))\n- https:\u002F\u002Fbrowserleaks.com\u002Fgeo\n- https:\u002F\u002Fbrowserleaks.com\u002Fjavascript\n- https:\u002F\u002Fbrowserleaks.com\u002Fheaders\n\n## Settings\n\n- **Location spoof** — enable\u002Fdisable geolocation override.\n- **Timezone spoof** — enable\u002Fdisable `Date` and `Intl.DateTimeFormat` timezone override.\n- **Language spoof** — enable\u002Fdisable `navigator.language(s)`, Intl locale, and `Accept-Language` header override.\n- **Regional font mask** — mask common Chinese system\u002Fvendor font probes for non-Chinese exit profiles.\n- **Reported accuracy (m)** — reported GPS accuracy, default 30 m.\n- **Auto-refresh interval (minutes)** — how often GeoMirror re-detects the exit IP.\n- **ipinfo.io token (optional)** — improves fallback reliability if you have a token.\n\n## Why each permission\n\n| Permission | Why |\n| --- | --- |\n| `storage` | Save settings and computed overrides locally. |\n| `alarms` | Schedule periodic exit-IP refresh. |\n| `declarativeNetRequest` | Set the outgoing `Accept-Language` header without reading page traffic. |\n| `\u003Call_urls>` content script | Patch browser APIs on normal web pages before page scripts run. |\n| `host_permissions` | Call the explicitly listed IP\u002Fgeolocation\u002FOverpass\u002Freverse-geocode providers. |\n\n## If you do not want to install this extension\n\nYou can give the following prompt to your coding agent to audit or build a local version. It includes the provider-timezone, first-read race, and font-probe details that are easy to miss:\n\n```text\nBuild an auditable Chrome Manifest V3 extension that aligns region signals visible to ordinary web pages with the current public exit IP.\n\nRequirements:\n1. State the scope precisely: ordinary Chrome pages only. Do not claim to modify the OS, Claude Code, terminal networking, DNS, TLS, proxies, or server-side risk controls.\n2. Detect the current public exit IP through Chrome's network stack with multiple IP-geolocation fallbacks. Prefer a result with a valid IANA timezone; if the first provider only has coordinates, continue instead of treating timezone:null as complete.\n3. Preserve country code, city\u002Fregion\u002Fcountry, coordinates, ISP, and IANA timezone. Infer navigator.language, navigator.languages, default Intl locale, and Accept-Language from country + timezone.\n4. Prefer a nearby OpenStreetMap Overpass highway=residential point over the raw IP centroid, with a boundary-safe jitter fallback.\n5. Use two content scripts:\n   - an isolated-world bridge that can read chrome.storage and publish a JSON payload to the DOM;\n   - a MAIN-world injector at document_start that patches page-visible APIs.\n6. MAIN world cannot synchronously read chrome.storage. Install a neutral first-read guard while waiting for the bridge so inline scripts cannot read the host's Asia\u002FShanghai \u002F UTC+8 first; replace it immediately when the exit profile arrives.\n7. Patch:\n   - navigator.geolocation.getCurrentPosition \u002F watchPosition \u002F clearWatch\n   - navigator.permissions.query for geolocation\n   - Date.prototype.getTimezoneOffset with DST-aware IANA timezone logic using the receiver Date instance\n   - Intl.DateTimeFormat default timezone and resolvedOptions().timeZone\n   - navigator.language and navigator.languages\n   - Intl.DateTimeFormat \u002F Intl.NumberFormat \u002F Intl.Collator default locale\n   - common Chinese system\u002Fvendor font probes through CanvasRenderingContext2D, OffscreenCanvas, FontFaceSet.check, and JS-assigned inline CSS; enable only for non-Chinese exit profiles\n8. Set outgoing Accept-Language through chrome.declarativeNetRequest and expose independent location\u002Ftimezone\u002Flanguage\u002Ffont toggles.\n9. Store settings and overrides only in chrome.storage.local. Never read page text, cookies, credentials, forms, or browsing history. Add no accounts, telemetry, analytics, remote config, or project backend.\n10. Do not claim zero network access. List every host_permission, public provider purpose, sent field, and fallback order.\n11. Test DST, Invalid Date, locale inference, provider timezone enrichment, timezone:null regression, font lists\u002Frewriting, injection order, and synchronous first-read behavior.\n12. Document uncovered surfaces separately: Web Workers, special iframes, Chrome privileged pages, and Claude Code \u002F CLI.\n```\n\n## Limitations\n\n- GeoMirror improves consistency. It is not a complete anti-fingerprinting system.\n- IP geolocation is approximate.\n- Locale inference is heuristic because IP providers do not know the real user language.\n- Chrome extensions cannot inject into `chrome:\u002F\u002F`, the Chrome Web Store, or other privileged pages.\n- The current implementation cannot change the system timezone or network environment seen by Claude Code or other native processes. CLI support remains on the roadmap.\n- Web Workers, SharedWorkers, Service Workers, and special `about:blank` \u002F `srcdoc` frames may still expose the host environment.\n- Some platforms may use additional risk signals outside browser JavaScript and headers.\n\n## Development\n\nProject layout:\n\n```\ngeomirror\u002F\n├── manifest.json\n├── background.js\n├── content-bridge.js\n├── content-inject.js\n├── docs\u002F\n│   └── TECHNICAL.md\n├── lib\u002F\n│   ├── geo.js\n│   ├── font-mask.js\n│   ├── locale.js\n│   ├── providers.js\n│   └── timezone.js\n├── popup.html\n├── popup.css\n├── popup.js\n├── test\u002F\n│   ├── inject-smoke.js\n│   └── run-tests.js\n└── icons\u002F\n```\n\nChecks:\n\n```bash\nnode test\u002Frun-tests.js\nnode test\u002Finject-smoke.js\nnode --check background.js\nnode --check content-inject.js\nnode --check content-bridge.js\nnode --check lib\u002Fproviders.js\nnode --check lib\u002Flocale.js\nnode --check lib\u002Ftimezone.js\nnode --check lib\u002Ffont-mask.js\nnode --check popup.js\n```\n\nAfter changing files, reload the extension in `chrome:\u002F\u002Fextensions`.\n\n## Contributing\n\nPull requests welcome. Keep the permission surface minimal and preserve the no-telemetry, no-page-content-reading guarantees.\n\n## License\n\n[MIT](.\u002FLICENSE)\n","GeoMirror 是一款 Chrome Manifest V3 浏览器扩展，用于使浏览器暴露的地理与区域信号（如地理位置、时区、语言、Accept-Language 及字体本地化）与当前可见 IP 地址的物理位置保持一致。它通过自动匹配 IP 对应的住宅级街道坐标，模拟真实本地环境，修正因使用代理、VPN 或远程网络出口导致的浏览器信号不一致问题。核心能力包括动态覆盖 navigator.geolocation、Intl 时区\u002F语言、Date 时区偏移及 HTTP 请求头等前端可读信号，仅作用于浏览器上下文，不影响系统级设置或网络层路由。适用于需规避基于区域指纹风控的场景，如 Anthropic\u002FClaude 等依赖多维地域信号的 AI 服务登录与持续使用。",2,"2026-07-09 02:30:09","CREATED_QUERY"]