How Claude Code bans are detected
The popular explanation is one sentence long — "it checks your IP" — and it is wrong in the detail that matters. Enforcement is layered, and the most famous mechanism of 2026 never read an IP address at all.
Five layers: account and ownership, environment signals, network and gateway domain, request contents, and behaviour. The 2026 request-side mechanism is the clearest example — it activated only when ANTHROPIC_BASE_URL was set, read the system timezone and the base-URL domain, and encoded the result into characters that are visually identical. It ran for roughly three months and was removed in July 2026.
Five layers, not one switch
| Layer | Signals | Under your control |
|---|---|---|
| Account | Registration entity, payment instrument, corporate ownership | Almost none |
| Environment | Timezone, language, region format, fingerprint | Yes — the only layer worth work |
| Network | Exit country and city, gateway domain | Partially, and overrated |
| Request | Whatever the client attaches | No, unless you patch the binary — prohibited |
| Behaviour | Concurrency, rate, sharing, registration bursts | Yes, and this is compliance, not evasion |
Account and ownership
The most decisive layer needs no technology at all. It rests on what you submitted: the registration entity, the country and institution behind the payment method, and — for business accounts — whether the ownership structure falls inside the 50% clause described in the previous guide.
That is precisely why network-level remedies fail here. You cannot change the issuing bank of a card with a proxy.
Environment
System timezone, preferred language, region format, browser fingerprint. The client and any web surface read these without special permission.
This layer matters because it goes inconsistent silently. A laptop that still reports the timezone it had before a trip, a browser whose language and region formats belong to two different places, an exit in a third — no sophisticated detection is required to see that. How to align it is the subject of the Chinese consistency checklist for now: 环境一致性自检清单.
Network and gateway domain
Exit IP geography is the traditional signal and its weight is routinely overestimated, because real users' exits move. The domain is more interesting.
According to the 2026 analysis, the client carried a built-in list of roughly 147 domains matched against whatever was configured in ANTHROPIC_BASE_URL. The list was described as containing country TLDs, major domestic platform domains, some internal hostnames, and a large number of third-party API relay services.
The 2026 request-side marker
This is the part most second-hand accounts get wrong, so it is worth stating precisely.
Trigger
The mechanism was not unconditional. Per the published analysis it activated when ANTHROPIC_BASE_URL was set — that is, when requests were pointed somewhere other than the official endpoint. Direct calls did not trigger it. For users who could not reach the official endpoint at all, that condition was effectively always true.
Two ways of deciding
- System timezone. Two specific timezone identifiers constituted a hit. Most people never change the OS timezone when they change networks, so this path had a very high hit rate.
- Domain matching. The host in
ANTHROPIC_BASE_URLwas compared against the embedded list, itself stored obfuscated.
How the verdict left the machine
No extra request, no suspicious traffic — the outcome was encoded into two characters of the system prompt that look entirely ordinary:
- The date separator. A hyphen became a slash in the date line when the timezone matched.
- The apostrophe. The character in
Today'swas swapped for one of four visually indistinguishable codepoints, each mapping to a different conclusion.
| Codepoint | Looks like | Reported meaning |
|---|---|---|
U+0027 | ' | Plain ASCII apostrophe, no list match |
U+2019 | ' | Domain list matched |
U+02BC | ʼ | Keyword match |
U+02B9 | ʹ | Both matched |
Four characters that an editor cannot distinguish, and that are entirely different values to a machine. That is why it survived unnoticed: nothing visible changed and no extra network behaviour occurred.
Behaviour
Unrelated to region policy, and the layer most misread in community accounts:
- One account used concurrently from several cities, or from three continents in a day.
- Request rates far above any individual's pattern, typically with scripted intervals.
- Account sharing or resale.
- Bursts of registrations from one device or one payment channel.
None of those need advanced detection. They are also why "we just shared one subscription" is such a poor idea — it trips this layer regardless of any network configuration.
Timeline
| When | What |
|---|---|
| September 2025 | Restrictions widened to entities more than 50% owned from unsupported regions |
| Early 2026 | The request-side marker runs, for roughly three months |
| Mid 2026 | Third-party analysis is published and widely discussed |
| July 2026 | The mechanism is removed; Anthropic describes it as an experiment |
| October 2026 | Compliance documentation still requires the binary to be unmodified |
What it was not
Not a backdoor. Information travelled outbound inside requests. There was no inbound channel, no remote execution.
Not source-code exfiltration. What was discussed was the substitution of specific characters in a prompt, not the upload of file contents.
Still a legitimate complaint. Marking requests without disclosure sits badly against a public commitment to transparency. The value of that discussion is not conspiracy — it is turning "what is the client actually doing" into a normal engineering question.
The outcome is the more durable lesson: this is a moving target. What you reverse-engineer today may be gone next release, and something new may exist that nobody has published. Any approach whose core is "defeat the detection" has a short half-life — which is the real argument against the third route in the hub.
Did Claude Code really embed a tracker in requests?
Third-party reverse engineering published in 2026 reported that builds with ANTHROPIC_BASE_URL set read the system timezone and matched the base URL against a built-in domain list, encoding the outcome into visually identical characters. It was removed in July 2026 after disclosure, and Anthropic described it as an experiment.
Was it a backdoor?
No. A backdoor is an inbound path into your machine; this carried information outbound. Calling it a backdoor is technically wrong, though the undisclosed marking is a fair objection.
Does knowing this help avoid a ban?
Largely not, and that is not the purpose. Ownership and request contents cannot be changed without patching the client, which the terms prohibit. The value is judging claims and not paying for fixes that cannot work. To limit the damage once it happens, see the recovery guide.