How Claude Code Detects China Users: Timezone, Steganography & Proxy Checks

When Claude Code connects to a non-official API endpoint through ANTHROPIC_BASE_URL, it performs a series of checks to determine whether the user is based in China. According to public reverse-engineering reports, this Claude Code China user detection mechanism relies on at least two signals: the operating system timezone and the proxy hostname. The results are then encoded steganographically into the system prompt — invisible to the user but readable by the model.

The Timezone Check — The Primary Signal

The most important signal in Claude Code China user detection is the system timezone. Claude Code reads the OS timezone — the same value your browser exposes through Intl.DateTimeFormat().resolvedOptions().timeZone. If the result is a China zone like Asia/Shanghai, Asia/Urumqi, or Asia/Chongqing, the detection triggers.

This is why timezone carries the highest weight in any browser fingerprint scanner that simulates Claude Code detection. In our tool at fuck-claude.app, the timezone signal alone accounts for 26 out of 100 possible risk points. Greater China zones like Asia/Hong_Kong, Asia/Macau, and Asia/Taipei also trigger a partial match.

Proxy Hostname Analysis

The second signal targets the proxy or API relay that Claude Code connects through. When a user configures ANTHROPIC_BASE_URL to point to a third-party endpoint, Claude Code reportedly inspects the hostname for keywords associated with Chinese AI labs, cloud providers, or known proxy services. Hostnames containing terms related to Chinese technology companies or AI research institutions can trigger the detection.

This check cannot be replicated in a browser fingerprint scanner since a website has no access to the user's Claude Code configuration. However, it is an important part of the overall China user detection pipeline to be aware of.

Unicode Steganography — How the Verdict Is Hidden

Once Claude Code determines whether the user appears to be China-based, it encodes this verdict into the system prompt using Unicode steganography. The encoding is remarkably subtle. In the "Today's date is ..." line of the system prompt, two modifications occur.

First, the date separator changes: a hyphen (-) in the standard format becomes a forward slash (/) when a China timezone is detected. Second, the apostrophe character in "Today's" rotates among four visually identical Unicode variants. Each variant encodes a different combination of flags — timezone match, hostname match, or both. To the human eye, these characters look identical. To the model reading the system prompt, they carry distinct meanings.

What Triggers a Flag vs. What Doesn't

Based on the reverse-engineering analysis, the strongest trigger for Claude Code China user detection is having Asia/Shanghai as your system timezone while connecting through a proxy whose hostname matches flagged patterns. Either signal alone may trigger a partial flag, but both together result in the strongest detection signal.

Users outside mainland China — including those in Singapore, Japan, South Korea, or Western countries — generally will not trigger the detection unless their system timezone is manually set to a China zone. Users who connect directly to the official Anthropic API without a proxy also bypass the hostname check entirely.

Browser Fingerprint Signals That Correlate

While Claude Code only checks timezone and proxy hostname, a browser fingerprint scanner can detect additional signals that correlate with being a China-based user. These include browser language settings (whether zh-CN is the primary language), installed Chinese fonts like Microsoft YaHei or PingFang SC, the Intl locale, timezone offset (UTC+8), and even WebGL renderer information that may reveal China-market hardware.

Our Claude Code China User Scanner at fuck-claude.app checks 11 such signals and produces a composite risk score from 0 to 100. The timezone signal is weighted highest (26 points) to match Claude Code's actual detection mechanism, while the remaining signals provide a broader picture of how "Chinese" your browser environment appears.

How to Lower Your Detection Risk

The most effective action is changing your operating system timezone away from China zones. Switching to America/New_York or Europe/London immediately eliminates the strongest signal. Adjusting your browser language preferences to place English above zh-CN also helps. For Claude Code specifically, avoiding proxy services with hostnames that contain flagged keywords is equally important.

You can test different configurations using the disguise simulator on our scanner tool. It lets you toggle individual signals on and off to see exactly how each change affects your overall risk score.