ВЕРСИИ (44)

### Fixed - **Bursts of logins no longer queue behind each other.** The lookup pool was sized to the number of providers, so one login used all of it and every other login waited, some until the 6 second total timeout and then got in unchecked. `api.max-parallel` now sizes the pool (default 64, up to 256). In a local join test, 21 of 60 joins in 6 seconds reached a provider before, all 60 now. ### Changed - **Staged lookups.** A lookup now asks the first two providers (`api.first-wave`, 0 asks all at once) and stops there when both answer and neither flags the address. A flag, a failure or a slow answer brings in the rest. Providers that are out of quota or recovering are skipped instead of being asked and failing. An ordinary address costs two requests instead of five, so the free quotas serve about twice as many new addresses. The default provider order puts the strongest keyless ones first (blackbox, ip-check, iplocate, ip-api, iprisk). - **Zowi's service is on by default, first in the list.** It was the strongest keyless provider in the public benchmark. The request uses `feature=security`, so only the verdict fields come back, and the provider limit is 120 a minute against the 150 the service allows per address. Existing configs keep their settings. - **Open proxies are blocked from a list.** monosans/proxy-list (MIT, rebuilt hourly, about 1,300 addresses) is a default list source. List entries may now be `socks5://1.2.3.4:1080`, `1.2.3.4:8080` or `[2001:db8::1]:8080`, only the address counts. proxifly's much larger, unverified list is in the config as a commented option. - **Offline network data.** `detection.network-data.source` takes the URL of a feed file that marks end-user networks and hosting-like ones. It is read from disk, so a lookup costs no request. Two uses, both set under the same key: `fallback-block-hosting` (on) refuses a hosting-like network when no provider could answer, and `fast-admit-end-user` (off) skips the provider lookup for end-user networks and keeps the quota for the rest. The source is empty by default. - **Redis no longer holds up the start or needs a reload.** With `storage.type: redis` the plugin answers from its local store at once and connects to Redis in the background, retrying every 5 to 60 seconds. A start while Redis is down and a recovery afterwards both work without anybody touching the plugin. - **Faster first start.** Without a cached list the download begins at once instead of after an 8 second grace period, and the sources load side by side (at most three connections per host, the network feed alongside). A fresh install is protected about a second after it enables instead of 13. - **A hosting flag alone no longer blocks.** `detection.hosting-min-score` (default 0.5) asks for at least that much score from other signals, so a provider tagging an ordinary ISP as hosting does not refuse a real player. Set it to 0 to block every hosting flag as before. - **New default providers.** ip-check is on. ipapi.is (answers without flags when it has no key), IPQuery and FreeIPAPI (flagged no proxy in a public benchmark) are off, which saves requests. Existing configs keep their settings.

### Fixed - **Bursts of logins no longer queue behind each other.** The lookup pool was sized to the number of providers, so one login used all of it and every other login waited, some until the 6 second total timeout and then got in unchecked. `api.max-parallel` now sizes the pool (default 64, up to 256). In a local join test, 21 of 60 joins in 6 seconds reached a provider before, all 60 now. ### Changed - **Staged lookups.** A lookup now asks the first two providers (`api.first-wave`, 0 asks all at once) and stops there when both answer and neither flags the address. A flag, a failure or a slow answer brings in the rest. Providers that are out of quota or recovering are skipped instead of being asked and failing. An ordinary address costs two requests instead of five, so the free quotas serve about twice as many new addresses. The default provider order puts the strongest keyless ones first (blackbox, ip-check, iplocate, ip-api, iprisk). - **Zowi's service is on by default, first in the list.** It was the strongest keyless provider in the public benchmark. The request uses `feature=security`, so only the verdict fields come back, and the provider limit is 120 a minute against the 150 the service allows per address. Existing configs keep their settings. - **Open proxies are blocked from a list.** monosans/proxy-list (MIT, rebuilt hourly, about 1,300 addresses) is a default list source. List entries may now be `socks5://1.2.3.4:1080`, `1.2.3.4:8080` or `[2001:db8::1]:8080`, only the address counts. proxifly's much larger, unverified list is in the config as a commented option. - **Offline network data.** `detection.network-data.source` takes the URL of a feed file that marks end-user networks and hosting-like ones. It is read from disk, so a lookup costs no request. Two uses, both set under the same key: `fallback-block-hosting` (on) refuses a hosting-like network when no provider could answer, and `fast-admit-end-user` (off) skips the provider lookup for end-user networks and keeps the quota for the rest. The source is empty by default. - **Redis no longer holds up the start or needs a reload.** With `storage.type: redis` the plugin answers from its local store at once and connects to Redis in the background, retrying every 5 to 60 seconds. A start while Redis is down and a recovery afterwards both work without anybody touching the plugin. - **Faster first start.** Without a cached list the download begins at once instead of after an 8 second grace period, and the sources load side by side (at most three connections per host, the network feed alongside). A fresh install is protected about a second after it enables instead of 13. - **A hosting flag alone no longer blocks.** `detection.hosting-min-score` (default 0.5) asks for at least that much score from other signals, so a provider tagging an ordinary ISP as hosting does not refuse a real player. Set it to 0 to block every hosting flag as before. - **New default providers.** ip-check is on. ipapi.is (answers without flags when it has no key), IPQuery and FreeIPAPI (flagged no proxy in a public benchmark) are off, which saves requests. Existing configs keep their settings.

### Fixed - **Bursts of logins no longer queue behind each other.** The lookup pool was sized to the number of providers, so one login used all of it and every other login waited, some until the 6 second total timeout and then got in unchecked. `api.max-parallel` now sizes the pool (default 64, up to 256). In a local join test, 21 of 60 joins in 6 seconds reached a provider before, all 60 now. ### Changed - **Staged lookups.** A lookup now asks the first two providers (`api.first-wave`, 0 asks all at once) and stops there when both answer and neither flags the address. A flag, a failure or a slow answer brings in the rest. Providers that are out of quota or recovering are skipped instead of being asked and failing. An ordinary address costs two requests instead of five, so the free quotas serve about twice as many new addresses. The default provider order puts the strongest keyless ones first (blackbox, ip-check, iplocate, ip-api, iprisk). - **Zowi's service is on by default, first in the list.** It was the strongest keyless provider in the public benchmark. The request uses `feature=security`, so only the verdict fields come back, and the provider limit is 120 a minute against the 150 the service allows per address. Existing configs keep their settings. - **Open proxies are blocked from a list.** monosans/proxy-list (MIT, rebuilt hourly, about 1,300 addresses) is a default list source. List entries may now be `socks5://1.2.3.4:1080`, `1.2.3.4:8080` or `[2001:db8::1]:8080`, only the address counts. proxifly's much larger, unverified list is in the config as a commented option. - **Offline network data.** `detection.network-data.source` takes the URL of a feed file that marks end-user networks and hosting-like ones. It is read from disk, so a lookup costs no request. Two uses, both set under the same key: `fallback-block-hosting` (on) refuses a hosting-like network when no provider could answer, and `fast-admit-end-user` (off) skips the provider lookup for end-user networks and keeps the quota for the rest. The source is empty by default. - **Redis no longer holds up the start or needs a reload.** With `storage.type: redis` the plugin answers from its local store at once and connects to Redis in the background, retrying every 5 to 60 seconds. A start while Redis is down and a recovery afterwards both work without anybody touching the plugin. - **Faster first start.** Without a cached list the download begins at once instead of after an 8 second grace period, and the sources load side by side (at most three connections per host, the network feed alongside). A fresh install is protected about a second after it enables instead of 13. - **A hosting flag alone no longer blocks.** `detection.hosting-min-score` (default 0.5) asks for at least that much score from other signals, so a provider tagging an ordinary ISP as hosting does not refuse a real player. Set it to 0 to block every hosting flag as before. - **New default providers.** ip-check is on. ipapi.is (answers without flags when it has no key), IPQuery and FreeIPAPI (flagged no proxy in a public benchmark) are off, which saves requests. Existing configs keep their settings.

### Fixed - **Bursts of logins no longer queue behind each other.** The lookup pool was sized to the number of providers, so one login used all of it and every other login waited, some until the 6 second total timeout and then got in unchecked. `api.max-parallel` now sizes the pool (default 64, up to 256). In a local join test, 21 of 60 joins in 6 seconds reached a provider before, all 60 now. ### Changed - **Staged lookups.** A lookup now asks the first two providers (`api.first-wave`, 0 asks all at once) and stops there when both answer and neither flags the address. A flag, a failure or a slow answer brings in the rest. Providers that are out of quota or recovering are skipped instead of being asked and failing. An ordinary address costs two requests instead of five, so the free quotas serve about twice as many new addresses. The default provider order puts the strongest keyless ones first (blackbox, ip-check, iplocate, ip-api, iprisk). - **Zowi's service is on by default, first in the list.** It was the strongest keyless provider in the public benchmark. The request uses `feature=security`, so only the verdict fields come back, and the provider limit is 120 a minute against the 150 the service allows per address. Existing configs keep their settings. - **Open proxies are blocked from a list.** monosans/proxy-list (MIT, rebuilt hourly, about 1,300 addresses) is a default list source. List entries may now be `socks5://1.2.3.4:1080`, `1.2.3.4:8080` or `[2001:db8::1]:8080`, only the address counts. proxifly's much larger, unverified list is in the config as a commented option. - **Offline network data.** `detection.network-data.source` takes the URL of a feed file that marks end-user networks and hosting-like ones. It is read from disk, so a lookup costs no request. Two uses, both set under the same key: `fallback-block-hosting` (on) refuses a hosting-like network when no provider could answer, and `fast-admit-end-user` (off) skips the provider lookup for end-user networks and keeps the quota for the rest. The source is empty by default. - **Redis no longer holds up the start or needs a reload.** With `storage.type: redis` the plugin answers from its local store at once and connects to Redis in the background, retrying every 5 to 60 seconds. A start while Redis is down and a recovery afterwards both work without anybody touching the plugin. - **Faster first start.** Without a cached list the download begins at once instead of after an 8 second grace period, and the sources load side by side (at most three connections per host, the network feed alongside). A fresh install is protected about a second after it enables instead of 13. - **A hosting flag alone no longer blocks.** `detection.hosting-min-score` (default 0.5) asks for at least that much score from other signals, so a provider tagging an ordinary ISP as hosting does not refuse a real player. Set it to 0 to block every hosting flag as before. - **New default providers.** ip-check is on. ipapi.is (answers without flags when it has no key), IPQuery and FreeIPAPI (flagged no proxy in a public benchmark) are off, which saves requests. Existing configs keep their settings.

### Fixed - **Bursts of logins no longer queue behind each other.** The lookup pool was sized to the number of providers, so one login used all of it and every other login waited, some until the 6 second total timeout and then got in unchecked. `api.max-parallel` now sizes the pool (default 64, up to 256). In a local join test, 21 of 60 joins in 6 seconds reached a provider before, all 60 now. ### Changed - **Staged lookups.** A lookup now asks the first two providers (`api.first-wave`, 0 asks all at once) and stops there when both answer and neither flags the address. A flag, a failure or a slow answer brings in the rest. Providers that are out of quota or recovering are skipped instead of being asked and failing. An ordinary address costs two requests instead of five, so the free quotas serve about twice as many new addresses. The default provider order puts the strongest keyless ones first (blackbox, ip-check, iplocate, ip-api, iprisk). - **Zowi's service is on by default, first in the list.** It was the strongest keyless provider in the public benchmark. The request uses `feature=security`, so only the verdict fields come back, and the provider limit is 120 a minute against the 150 the service allows per address. Existing configs keep their settings. - **Open proxies are blocked from a list.** monosans/proxy-list (MIT, rebuilt hourly, about 1,300 addresses) is a default list source. List entries may now be `socks5://1.2.3.4:1080`, `1.2.3.4:8080` or `[2001:db8::1]:8080`, only the address counts. proxifly's much larger, unverified list is in the config as a commented option. - **Offline network data.** `detection.network-data.source` takes the URL of a feed file that marks end-user networks and hosting-like ones. It is read from disk, so a lookup costs no request. Two uses, both set under the same key: `fallback-block-hosting` (on) refuses a hosting-like network when no provider could answer, and `fast-admit-end-user` (off) skips the provider lookup for end-user networks and keeps the quota for the rest. The source is empty by default. - **Redis no longer holds up the start or needs a reload.** With `storage.type: redis` the plugin answers from its local store at once and connects to Redis in the background, retrying every 5 to 60 seconds. A start while Redis is down and a recovery afterwards both work without anybody touching the plugin. - **Faster first start.** Without a cached list the download begins at once instead of after an 8 second grace period, and the sources load side by side (at most three connections per host, the network feed alongside). A fresh install is protected about a second after it enables instead of 13. - **A hosting flag alone no longer blocks.** `detection.hosting-min-score` (default 0.5) asks for at least that much score from other signals, so a provider tagging an ordinary ISP as hosting does not refuse a real player. Set it to 0 to block every hosting flag as before. - **New default providers.** ip-check is on. ipapi.is (answers without flags when it has no key), IPQuery and FreeIPAPI (flagged no proxy in a public benchmark) are off, which saves requests. Existing configs keep their settings.

### Fixed - **Bursts of logins no longer queue behind each other.** The lookup pool was sized to the number of providers, so one login used all of it and every other login waited, some until the 6 second total timeout and then got in unchecked. `api.max-parallel` now sizes the pool (default 64, up to 256). In a local join test, 21 of 60 joins in 6 seconds reached a provider before, all 60 now. ### Changed - **Staged lookups.** A lookup now asks the first two providers (`api.first-wave`, 0 asks all at once) and stops there when both answer and neither flags the address. A flag, a failure or a slow answer brings in the rest. Providers that are out of quota or recovering are skipped instead of being asked and failing. An ordinary address costs two requests instead of five, so the free quotas serve about twice as many new addresses. The default provider order puts the strongest keyless ones first (blackbox, ip-check, iplocate, ip-api, iprisk). - **Zowi's service is on by default, first in the list.** It was the strongest keyless provider in the public benchmark. The request uses `feature=security`, so only the verdict fields come back, and the provider limit is 120 a minute against the 150 the service allows per address. Existing configs keep their settings. - **Open proxies are blocked from a list.** monosans/proxy-list (MIT, rebuilt hourly, about 1,300 addresses) is a default list source. List entries may now be `socks5://1.2.3.4:1080`, `1.2.3.4:8080` or `[2001:db8::1]:8080`, only the address counts. proxifly's much larger, unverified list is in the config as a commented option. - **Offline network data.** `detection.network-data.source` takes the URL of a feed file that marks end-user networks and hosting-like ones. It is read from disk, so a lookup costs no request. Two uses, both set under the same key: `fallback-block-hosting` (on) refuses a hosting-like network when no provider could answer, and `fast-admit-end-user` (off) skips the provider lookup for end-user networks and keeps the quota for the rest. The source is empty by default. - **Redis no longer holds up the start or needs a reload.** With `storage.type: redis` the plugin answers from its local store at once and connects to Redis in the background, retrying every 5 to 60 seconds. A start while Redis is down and a recovery afterwards both work without anybody touching the plugin. - **Faster first start.** Without a cached list the download begins at once instead of after an 8 second grace period, and the sources load side by side (at most three connections per host, the network feed alongside). A fresh install is protected about a second after it enables instead of 13. - **A hosting flag alone no longer blocks.** `detection.hosting-min-score` (default 0.5) asks for at least that much score from other signals, so a provider tagging an ordinary ISP as hosting does not refuse a real player. Set it to 0 to block every hosting flag as before. - **New default providers.** ip-check is on. ipapi.is (answers without flags when it has no key), IPQuery and FreeIPAPI (flagged no proxy in a public benchmark) are off, which saves requests. Existing configs keep their settings.

### Added - **Rules on provider answers.** Every provider, listed or your own, takes a `conditions` block with named groups of `<field> <op> <value>` lines. A `bypass` group that matches clears every flag the provider raised, a `flag` group raises one the field mapping did not. Lines inside a group must all hold, any one group is enough. Numbers compare as numbers, text ignoring case, and a field missing from the answer never satisfies a line. An unreadable line is skipped with a warning at start-up instead of taking the whole config down. - **Request headers per provider.** `headers:` adds any header to a provider's request, with `{key}` and `{ip}` filled in, for services that want `Authorization: Bearer ...` or similar. - **`settings.debug`** prints every provider answer, raw body included, next to what was read from it. That is what you write conditions against. - **ISP filter.** `detection.isp.blocked` and `detection.isp.allowed` take case-insensitive regular expressions matched against the provider's ISP name. An allowed ISP outranks the proxy and hosting flags, which makes it the place for a mobile carrier that keeps getting flagged. - **Downloadable ASN lists.** `detection.asn.sources` takes https URLs serving a JSON array or plain text with one network per line. They refresh with the address feeds, and the last good download is kept in `asn-cache.txt`. - **Bogon addresses are refused.** Documentation, benchmark, multicast and reserved ranges cannot belong to a real player; one of them at login means a forwarding layer was given a false address. Private and Tailscale ranges are not affected. `detection.block-bogon: false` turns it off. - **Connection limit.** `limiter` caps accounts per address as a hard rule, either counting who is online right now or counting admissions inside a window such as `30m`, which resets on its own. Whitelisted, local and bypassing players never count. Off by default. - **Restricted servers** on BungeeCord and Velocity. With `restricted.enabled`, a flagged player is not disconnected but kept on the backends you list, for example the lobby and the login server. On the first connect they are routed to the first allowed backend, and disconnected only if none exists. - **Passive mode.** `detection.passive` checks nobody at login. `/proxyshield check` and the API keep working, so ProxyShield can sit next to another anti-VPN as a lookup tool. - **Telegram and VK alerts**, plain text with the same placeholders as the console line, sent through the same bounded queue model as the Discord webhook. - **`/proxyshield alts <ip|player>`** lists every account seen on the same address, newest first. The history lives in `alts.tsv` next to the config, is pruned after `alts.retention-days`, and groups IPv6 clients by their /64 the same way the cache does. - **Whitelist and blacklist entries with a reason and an expiry.** `/proxyshield whitelist add <entry> [30m|12h|7d|perm] [reason...]` stores who added the entry, when, why, and until when. `info` shows that, `purge` clears every in-game entry, and `list` marks the timed ones. A timed entry stops matching the moment it runs out, not at the next save. Files written by older builds load unchanged, and a note written by hand after `#` is kept as the reason. - `/proxyshield stats` counts network/ISP, account-limit and bogon blocks. ### Changed - **The ISP name is the one most providers agree on**, not the first that answered. Providers disagree on names more than on anything else: for 1.1.1.1 one reports Cloudflare and another the registrant of the block, APNIC. Which of those landed in the alert and in the ISP filter used to depend on network timing. ### Upgrading New options take effect with their defaults even when your `config.yml` does not list them yet: bogon blocking and the account history are on, everything else is off. To see and change them, compare your file with the new default or let the plugin write a fresh one. ### Testing Live on Paper 1.21.11: bogon refusal, the ISP filter, a flag condition on a custom provider, debug output, timed whitelist entries with `info` and `purge`, and the account history with two connecting clients. Telegram, VK, the connection limit and restricted servers are covered by unit tests only so far; the last two cannot be exercised from a loopback address, which ProxyShield never checks.

### Added - **Rules on provider answers.** Every provider, listed or your own, takes a `conditions` block with named groups of `<field> <op> <value>` lines. A `bypass` group that matches clears every flag the provider raised, a `flag` group raises one the field mapping did not. Lines inside a group must all hold, any one group is enough. Numbers compare as numbers, text ignoring case, and a field missing from the answer never satisfies a line. An unreadable line is skipped with a warning at start-up instead of taking the whole config down. - **Request headers per provider.** `headers:` adds any header to a provider's request, with `{key}` and `{ip}` filled in, for services that want `Authorization: Bearer ...` or similar. - **`settings.debug`** prints every provider answer, raw body included, next to what was read from it. That is what you write conditions against. - **ISP filter.** `detection.isp.blocked` and `detection.isp.allowed` take case-insensitive regular expressions matched against the provider's ISP name. An allowed ISP outranks the proxy and hosting flags, which makes it the place for a mobile carrier that keeps getting flagged. - **Downloadable ASN lists.** `detection.asn.sources` takes https URLs serving a JSON array or plain text with one network per line. They refresh with the address feeds, and the last good download is kept in `asn-cache.txt`. - **Bogon addresses are refused.** Documentation, benchmark, multicast and reserved ranges cannot belong to a real player; one of them at login means a forwarding layer was given a false address. Private and Tailscale ranges are not affected. `detection.block-bogon: false` turns it off. - **Connection limit.** `limiter` caps accounts per address as a hard rule, either counting who is online right now or counting admissions inside a window such as `30m`, which resets on its own. Whitelisted, local and bypassing players never count. Off by default. - **Restricted servers** on BungeeCord and Velocity. With `restricted.enabled`, a flagged player is not disconnected but kept on the backends you list, for example the lobby and the login server. On the first connect they are routed to the first allowed backend, and disconnected only if none exists. - **Passive mode.** `detection.passive` checks nobody at login. `/proxyshield check` and the API keep working, so ProxyShield can sit next to another anti-VPN as a lookup tool. - **Telegram and VK alerts**, plain text with the same placeholders as the console line, sent through the same bounded queue model as the Discord webhook. - **`/proxyshield alts <ip|player>`** lists every account seen on the same address, newest first. The history lives in `alts.tsv` next to the config, is pruned after `alts.retention-days`, and groups IPv6 clients by their /64 the same way the cache does. - **Whitelist and blacklist entries with a reason and an expiry.** `/proxyshield whitelist add <entry> [30m|12h|7d|perm] [reason...]` stores who added the entry, when, why, and until when. `info` shows that, `purge` clears every in-game entry, and `list` marks the timed ones. A timed entry stops matching the moment it runs out, not at the next save. Files written by older builds load unchanged, and a note written by hand after `#` is kept as the reason. - `/proxyshield stats` counts network/ISP, account-limit and bogon blocks. ### Changed - **The ISP name is the one most providers agree on**, not the first that answered. Providers disagree on names more than on anything else: for 1.1.1.1 one reports Cloudflare and another the registrant of the block, APNIC. Which of those landed in the alert and in the ISP filter used to depend on network timing. ### Upgrading New options take effect with their defaults even when your `config.yml` does not list them yet: bogon blocking and the account history are on, everything else is off. To see and change them, compare your file with the new default or let the plugin write a fresh one. ### Testing Live on Paper 1.21.11: bogon refusal, the ISP filter, a flag condition on a custom provider, debug output, timed whitelist entries with `info` and `purge`, and the account history with two connecting clients. Telegram, VK, the connection limit and restricted servers are covered by unit tests only so far; the last two cannot be exercised from a loopback address, which ProxyShield never checks.

### Added - **Rules on provider answers.** Every provider, listed or your own, takes a `conditions` block with named groups of `<field> <op> <value>` lines. A `bypass` group that matches clears every flag the provider raised, a `flag` group raises one the field mapping did not. Lines inside a group must all hold, any one group is enough. Numbers compare as numbers, text ignoring case, and a field missing from the answer never satisfies a line. An unreadable line is skipped with a warning at start-up instead of taking the whole config down. - **Request headers per provider.** `headers:` adds any header to a provider's request, with `{key}` and `{ip}` filled in, for services that want `Authorization: Bearer ...` or similar. - **`settings.debug`** prints every provider answer, raw body included, next to what was read from it. That is what you write conditions against. - **ISP filter.** `detection.isp.blocked` and `detection.isp.allowed` take case-insensitive regular expressions matched against the provider's ISP name. An allowed ISP outranks the proxy and hosting flags, which makes it the place for a mobile carrier that keeps getting flagged. - **Downloadable ASN lists.** `detection.asn.sources` takes https URLs serving a JSON array or plain text with one network per line. They refresh with the address feeds, and the last good download is kept in `asn-cache.txt`. - **Bogon addresses are refused.** Documentation, benchmark, multicast and reserved ranges cannot belong to a real player; one of them at login means a forwarding layer was given a false address. Private and Tailscale ranges are not affected. `detection.block-bogon: false` turns it off. - **Connection limit.** `limiter` caps accounts per address as a hard rule, either counting who is online right now or counting admissions inside a window such as `30m`, which resets on its own. Whitelisted, local and bypassing players never count. Off by default. - **Restricted servers** on BungeeCord and Velocity. With `restricted.enabled`, a flagged player is not disconnected but kept on the backends you list, for example the lobby and the login server. On the first connect they are routed to the first allowed backend, and disconnected only if none exists. - **Passive mode.** `detection.passive` checks nobody at login. `/proxyshield check` and the API keep working, so ProxyShield can sit next to another anti-VPN as a lookup tool. - **Telegram and VK alerts**, plain text with the same placeholders as the console line, sent through the same bounded queue model as the Discord webhook. - **`/proxyshield alts <ip|player>`** lists every account seen on the same address, newest first. The history lives in `alts.tsv` next to the config, is pruned after `alts.retention-days`, and groups IPv6 clients by their /64 the same way the cache does. - **Whitelist and blacklist entries with a reason and an expiry.** `/proxyshield whitelist add <entry> [30m|12h|7d|perm] [reason...]` stores who added the entry, when, why, and until when. `info` shows that, `purge` clears every in-game entry, and `list` marks the timed ones. A timed entry stops matching the moment it runs out, not at the next save. Files written by older builds load unchanged, and a note written by hand after `#` is kept as the reason. - `/proxyshield stats` counts network/ISP, account-limit and bogon blocks. ### Changed - **The ISP name is the one most providers agree on**, not the first that answered. Providers disagree on names more than on anything else: for 1.1.1.1 one reports Cloudflare and another the registrant of the block, APNIC. Which of those landed in the alert and in the ISP filter used to depend on network timing. ### Upgrading New options take effect with their defaults even when your `config.yml` does not list them yet: bogon blocking and the account history are on, everything else is off. To see and change them, compare your file with the new default or let the plugin write a fresh one. ### Testing Live on Paper 1.21.11: bogon refusal, the ISP filter, a flag condition on a custom provider, debug output, timed whitelist entries with `info` and `purge`, and the account history with two connecting clients. Telegram, VK, the connection limit and restricted servers are covered by unit tests only so far; the last two cannot be exercised from a loopback address, which ProxyShield never checks.

### Added - **Rules on provider answers.** Every provider, listed or your own, takes a `conditions` block with named groups of `<field> <op> <value>` lines. A `bypass` group that matches clears every flag the provider raised, a `flag` group raises one the field mapping did not. Lines inside a group must all hold, any one group is enough. Numbers compare as numbers, text ignoring case, and a field missing from the answer never satisfies a line. An unreadable line is skipped with a warning at start-up instead of taking the whole config down. - **Request headers per provider.** `headers:` adds any header to a provider's request, with `{key}` and `{ip}` filled in, for services that want `Authorization: Bearer ...` or similar. - **`settings.debug`** prints every provider answer, raw body included, next to what was read from it. That is what you write conditions against. - **ISP filter.** `detection.isp.blocked` and `detection.isp.allowed` take case-insensitive regular expressions matched against the provider's ISP name. An allowed ISP outranks the proxy and hosting flags, which makes it the place for a mobile carrier that keeps getting flagged. - **Downloadable ASN lists.** `detection.asn.sources` takes https URLs serving a JSON array or plain text with one network per line. They refresh with the address feeds, and the last good download is kept in `asn-cache.txt`. - **Bogon addresses are refused.** Documentation, benchmark, multicast and reserved ranges cannot belong to a real player; one of them at login means a forwarding layer was given a false address. Private and Tailscale ranges are not affected. `detection.block-bogon: false` turns it off. - **Connection limit.** `limiter` caps accounts per address as a hard rule, either counting who is online right now or counting admissions inside a window such as `30m`, which resets on its own. Whitelisted, local and bypassing players never count. Off by default. - **Restricted servers** on BungeeCord and Velocity. With `restricted.enabled`, a flagged player is not disconnected but kept on the backends you list, for example the lobby and the login server. On the first connect they are routed to the first allowed backend, and disconnected only if none exists. - **Passive mode.** `detection.passive` checks nobody at login. `/proxyshield check` and the API keep working, so ProxyShield can sit next to another anti-VPN as a lookup tool. - **Telegram and VK alerts**, plain text with the same placeholders as the console line, sent through the same bounded queue model as the Discord webhook. - **`/proxyshield alts <ip|player>`** lists every account seen on the same address, newest first. The history lives in `alts.tsv` next to the config, is pruned after `alts.retention-days`, and groups IPv6 clients by their /64 the same way the cache does. - **Whitelist and blacklist entries with a reason and an expiry.** `/proxyshield whitelist add <entry> [30m|12h|7d|perm] [reason...]` stores who added the entry, when, why, and until when. `info` shows that, `purge` clears every in-game entry, and `list` marks the timed ones. A timed entry stops matching the moment it runs out, not at the next save. Files written by older builds load unchanged, and a note written by hand after `#` is kept as the reason. - `/proxyshield stats` counts network/ISP, account-limit and bogon blocks. ### Changed - **The ISP name is the one most providers agree on**, not the first that answered. Providers disagree on names more than on anything else: for 1.1.1.1 one reports Cloudflare and another the registrant of the block, APNIC. Which of those landed in the alert and in the ISP filter used to depend on network timing. ### Upgrading New options take effect with their defaults even when your `config.yml` does not list them yet: bogon blocking and the account history are on, everything else is off. To see and change them, compare your file with the new default or let the plugin write a fresh one. ### Testing Live on Paper 1.21.11: bogon refusal, the ISP filter, a flag condition on a custom provider, debug output, timed whitelist entries with `info` and `purge`, and the account history with two connecting clients. Telegram, VK, the connection limit and restricted servers are covered by unit tests only so far; the last two cannot be exercised from a loopback address, which ProxyShield never checks.

### Added - **Rules on provider answers.** Every provider, listed or your own, takes a `conditions` block with named groups of `<field> <op> <value>` lines. A `bypass` group that matches clears every flag the provider raised, a `flag` group raises one the field mapping did not. Lines inside a group must all hold, any one group is enough. Numbers compare as numbers, text ignoring case, and a field missing from the answer never satisfies a line. An unreadable line is skipped with a warning at start-up instead of taking the whole config down. - **Request headers per provider.** `headers:` adds any header to a provider's request, with `{key}` and `{ip}` filled in, for services that want `Authorization: Bearer ...` or similar. - **`settings.debug`** prints every provider answer, raw body included, next to what was read from it. That is what you write conditions against. - **ISP filter.** `detection.isp.blocked` and `detection.isp.allowed` take case-insensitive regular expressions matched against the provider's ISP name. An allowed ISP outranks the proxy and hosting flags, which makes it the place for a mobile carrier that keeps getting flagged. - **Downloadable ASN lists.** `detection.asn.sources` takes https URLs serving a JSON array or plain text with one network per line. They refresh with the address feeds, and the last good download is kept in `asn-cache.txt`. - **Bogon addresses are refused.** Documentation, benchmark, multicast and reserved ranges cannot belong to a real player; one of them at login means a forwarding layer was given a false address. Private and Tailscale ranges are not affected. `detection.block-bogon: false` turns it off. - **Connection limit.** `limiter` caps accounts per address as a hard rule, either counting who is online right now or counting admissions inside a window such as `30m`, which resets on its own. Whitelisted, local and bypassing players never count. Off by default. - **Restricted servers** on BungeeCord and Velocity. With `restricted.enabled`, a flagged player is not disconnected but kept on the backends you list, for example the lobby and the login server. On the first connect they are routed to the first allowed backend, and disconnected only if none exists. - **Passive mode.** `detection.passive` checks nobody at login. `/proxyshield check` and the API keep working, so ProxyShield can sit next to another anti-VPN as a lookup tool. - **Telegram and VK alerts**, plain text with the same placeholders as the console line, sent through the same bounded queue model as the Discord webhook. - **`/proxyshield alts <ip|player>`** lists every account seen on the same address, newest first. The history lives in `alts.tsv` next to the config, is pruned after `alts.retention-days`, and groups IPv6 clients by their /64 the same way the cache does. - **Whitelist and blacklist entries with a reason and an expiry.** `/proxyshield whitelist add <entry> [30m|12h|7d|perm] [reason...]` stores who added the entry, when, why, and until when. `info` shows that, `purge` clears every in-game entry, and `list` marks the timed ones. A timed entry stops matching the moment it runs out, not at the next save. Files written by older builds load unchanged, and a note written by hand after `#` is kept as the reason. - `/proxyshield stats` counts network/ISP, account-limit and bogon blocks. ### Changed - **The ISP name is the one most providers agree on**, not the first that answered. Providers disagree on names more than on anything else: for 1.1.1.1 one reports Cloudflare and another the registrant of the block, APNIC. Which of those landed in the alert and in the ISP filter used to depend on network timing. ### Upgrading New options take effect with their defaults even when your `config.yml` does not list them yet: bogon blocking and the account history are on, everything else is off. To see and change them, compare your file with the new default or let the plugin write a fresh one. ### Testing Live on Paper 1.21.11: bogon refusal, the ISP filter, a flag condition on a custom provider, debug output, timed whitelist entries with `info` and `purge`, and the account history with two connecting clients. Telegram, VK, the connection limit and restricted servers are covered by unit tests only so far; the last two cannot be exercised from a loopback address, which ProxyShield never checks.

### Added - **Rules on provider answers.** Every provider, listed or your own, takes a `conditions` block with named groups of `<field> <op> <value>` lines. A `bypass` group that matches clears every flag the provider raised, a `flag` group raises one the field mapping did not. Lines inside a group must all hold, any one group is enough. Numbers compare as numbers, text ignoring case, and a field missing from the answer never satisfies a line. An unreadable line is skipped with a warning at start-up instead of taking the whole config down. - **Request headers per provider.** `headers:` adds any header to a provider's request, with `{key}` and `{ip}` filled in, for services that want `Authorization: Bearer ...` or similar. - **`settings.debug`** prints every provider answer, raw body included, next to what was read from it. That is what you write conditions against. - **ISP filter.** `detection.isp.blocked` and `detection.isp.allowed` take case-insensitive regular expressions matched against the provider's ISP name. An allowed ISP outranks the proxy and hosting flags, which makes it the place for a mobile carrier that keeps getting flagged. - **Downloadable ASN lists.** `detection.asn.sources` takes https URLs serving a JSON array or plain text with one network per line. They refresh with the address feeds, and the last good download is kept in `asn-cache.txt`. - **Bogon addresses are refused.** Documentation, benchmark, multicast and reserved ranges cannot belong to a real player; one of them at login means a forwarding layer was given a false address. Private and Tailscale ranges are not affected. `detection.block-bogon: false` turns it off. - **Connection limit.** `limiter` caps accounts per address as a hard rule, either counting who is online right now or counting admissions inside a window such as `30m`, which resets on its own. Whitelisted, local and bypassing players never count. Off by default. - **Restricted servers** on BungeeCord and Velocity. With `restricted.enabled`, a flagged player is not disconnected but kept on the backends you list, for example the lobby and the login server. On the first connect they are routed to the first allowed backend, and disconnected only if none exists. - **Passive mode.** `detection.passive` checks nobody at login. `/proxyshield check` and the API keep working, so ProxyShield can sit next to another anti-VPN as a lookup tool. - **Telegram and VK alerts**, plain text with the same placeholders as the console line, sent through the same bounded queue model as the Discord webhook. - **`/proxyshield alts <ip|player>`** lists every account seen on the same address, newest first. The history lives in `alts.tsv` next to the config, is pruned after `alts.retention-days`, and groups IPv6 clients by their /64 the same way the cache does. - **Whitelist and blacklist entries with a reason and an expiry.** `/proxyshield whitelist add <entry> [30m|12h|7d|perm] [reason...]` stores who added the entry, when, why, and until when. `info` shows that, `purge` clears every in-game entry, and `list` marks the timed ones. A timed entry stops matching the moment it runs out, not at the next save. Files written by older builds load unchanged, and a note written by hand after `#` is kept as the reason. - `/proxyshield stats` counts network/ISP, account-limit and bogon blocks. ### Changed - **The ISP name is the one most providers agree on**, not the first that answered. Providers disagree on names more than on anything else: for 1.1.1.1 one reports Cloudflare and another the registrant of the block, APNIC. Which of those landed in the alert and in the ISP filter used to depend on network timing. ### Upgrading New options take effect with their defaults even when your `config.yml` does not list them yet: bogon blocking and the account history are on, everything else is off. To see and change them, compare your file with the new default or let the plugin write a fresh one. ### Testing Live on Paper 1.21.11: bogon refusal, the ISP filter, a flag condition on a custom provider, debug output, timed whitelist entries with `info` and `purge`, and the account history with two connecting clients. Telegram, VK, the connection limit and restricted servers are covered by unit tests only so far; the last two cannot be exercised from a loopback address, which ProxyShield never checks.

## Fixed Five defects that let a commercial VPN connect unflagged. They compound: with the shipped configuration, four of six real ProtonVPN exits passed every check. All six are stopped now, and ten consumer ISP and mobile addresses across seven countries still connect. **`business` counted as a residential connection.** `detection.allow-residential-hosting` therefore waved every VPN operator past the hosting block. In iplocate's vocabulary a home line is `isp`, a datacenter is `hosting`, and `business` is a corporate network, which is exactly what a VPN company announcing its own ASN looks like. The exemption now covers residential, mobile, cellular and `isp` only. **The reverse DNS check found no name for any VPN exit.** It went through `InetAddress.getCanonicalHostName()`, which performs a forward confirmed reverse lookup and discards the PTR unless the name it returns resolves back to the same address. VPN operators routinely publish a PTR with no matching A record, so the JDK handed back the literal, which reads as "no PTR at all". Every ProtonVPN exit answers `185-70-41-1.protonmail.ch` to `dig` and that name has no A record. The PTR is now read directly, with the JDK call kept as a fallback. The DNS context is built once rather than per query, which is what kept the first lookup inside the 700 ms budget. **The one built-in rDNS pattern aimed at Proton never matched Proton.** The list carried `protonvpn`; Proton names its exits after the mail brand. Of the seventeen ranges Proton announces, ten publish a PTR and none matched. `protonmail` is in the list now, and `hosted` joins `hosting` because `hosted-by-<name>.net` is a common shape the longer word does not cover. **`ipapi-is` failed on every request and said so nowhere.** It is the highest weighted provider in the shipped configuration at 1.5, and without a key ipapi.is answers on its anonymous tier: eleven flat keys, none of the risk fields, `company` and `asn` as plain strings rather than objects. Every documented path found nothing, so it returned `response carried none of the expected fields` every time and silently contributed zero. It now reads that shape too, so an unkeyed install still gets the country, the ISP and the network from it. It still cannot judge a VPN without a key, so the first time any provider answers without a single risk field the console says which one, what it costs and what to do. **A clean verdict from an incomplete round was cached for six hours.** One provider answering "not a proxy" is enough to settle a consensus round, so a rate limit or a timeout on the single provider that would have flagged the address produced a clean answer that sat in the cache for the full `api.cache-minutes` and survived restarts through `lookup-cache.json`. A clean verdict now gets the configured lifetime only when every provider actually answered; otherwise it is kept for five minutes, which still absorbs a burst of logins. Flagged verdicts are unaffected, and so is a round that stopped early because the score was already reached. `/proxyshield clearcache` empties both the in-memory cache and the stored one, which is the supported way to force a re-check. Config files from 2.4 and 2.5.0 work unchanged.

## Fixed Five defects that let a commercial VPN connect unflagged. They compound: with the shipped configuration, four of six real ProtonVPN exits passed every check. All six are stopped now, and ten consumer ISP and mobile addresses across seven countries still connect. **`business` counted as a residential connection.** `detection.allow-residential-hosting` therefore waved every VPN operator past the hosting block. In iplocate's vocabulary a home line is `isp`, a datacenter is `hosting`, and `business` is a corporate network, which is exactly what a VPN company announcing its own ASN looks like. The exemption now covers residential, mobile, cellular and `isp` only. **The reverse DNS check found no name for any VPN exit.** It went through `InetAddress.getCanonicalHostName()`, which performs a forward confirmed reverse lookup and discards the PTR unless the name it returns resolves back to the same address. VPN operators routinely publish a PTR with no matching A record, so the JDK handed back the literal, which reads as "no PTR at all". Every ProtonVPN exit answers `185-70-41-1.protonmail.ch` to `dig` and that name has no A record. The PTR is now read directly, with the JDK call kept as a fallback. The DNS context is built once rather than per query, which is what kept the first lookup inside the 700 ms budget. **The one built-in rDNS pattern aimed at Proton never matched Proton.** The list carried `protonvpn`; Proton names its exits after the mail brand. Of the seventeen ranges Proton announces, ten publish a PTR and none matched. `protonmail` is in the list now, and `hosted` joins `hosting` because `hosted-by-<name>.net` is a common shape the longer word does not cover. **`ipapi-is` failed on every request and said so nowhere.** It is the highest weighted provider in the shipped configuration at 1.5, and without a key ipapi.is answers on its anonymous tier: eleven flat keys, none of the risk fields, `company` and `asn` as plain strings rather than objects. Every documented path found nothing, so it returned `response carried none of the expected fields` every time and silently contributed zero. It now reads that shape too, so an unkeyed install still gets the country, the ISP and the network from it. It still cannot judge a VPN without a key, so the first time any provider answers without a single risk field the console says which one, what it costs and what to do. **A clean verdict from an incomplete round was cached for six hours.** One provider answering "not a proxy" is enough to settle a consensus round, so a rate limit or a timeout on the single provider that would have flagged the address produced a clean answer that sat in the cache for the full `api.cache-minutes` and survived restarts through `lookup-cache.json`. A clean verdict now gets the configured lifetime only when every provider actually answered; otherwise it is kept for five minutes, which still absorbs a burst of logins. Flagged verdicts are unaffected, and so is a round that stopped early because the score was already reached. `/proxyshield clearcache` empties both the in-memory cache and the stored one, which is the supported way to force a re-check. Config files from 2.4 and 2.5.0 work unchanged.

## Fixed Five defects that let a commercial VPN connect unflagged. They compound: with the shipped configuration, four of six real ProtonVPN exits passed every check. All six are stopped now, and ten consumer ISP and mobile addresses across seven countries still connect. **`business` counted as a residential connection.** `detection.allow-residential-hosting` therefore waved every VPN operator past the hosting block. In iplocate's vocabulary a home line is `isp`, a datacenter is `hosting`, and `business` is a corporate network, which is exactly what a VPN company announcing its own ASN looks like. The exemption now covers residential, mobile, cellular and `isp` only. **The reverse DNS check found no name for any VPN exit.** It went through `InetAddress.getCanonicalHostName()`, which performs a forward confirmed reverse lookup and discards the PTR unless the name it returns resolves back to the same address. VPN operators routinely publish a PTR with no matching A record, so the JDK handed back the literal, which reads as "no PTR at all". Every ProtonVPN exit answers `185-70-41-1.protonmail.ch` to `dig` and that name has no A record. The PTR is now read directly, with the JDK call kept as a fallback. The DNS context is built once rather than per query, which is what kept the first lookup inside the 700 ms budget. **The one built-in rDNS pattern aimed at Proton never matched Proton.** The list carried `protonvpn`; Proton names its exits after the mail brand. Of the seventeen ranges Proton announces, ten publish a PTR and none matched. `protonmail` is in the list now, and `hosted` joins `hosting` because `hosted-by-<name>.net` is a common shape the longer word does not cover. **`ipapi-is` failed on every request and said so nowhere.** It is the highest weighted provider in the shipped configuration at 1.5, and without a key ipapi.is answers on its anonymous tier: eleven flat keys, none of the risk fields, `company` and `asn` as plain strings rather than objects. Every documented path found nothing, so it returned `response carried none of the expected fields` every time and silently contributed zero. It now reads that shape too, so an unkeyed install still gets the country, the ISP and the network from it. It still cannot judge a VPN without a key, so the first time any provider answers without a single risk field the console says which one, what it costs and what to do. **A clean verdict from an incomplete round was cached for six hours.** One provider answering "not a proxy" is enough to settle a consensus round, so a rate limit or a timeout on the single provider that would have flagged the address produced a clean answer that sat in the cache for the full `api.cache-minutes` and survived restarts through `lookup-cache.json`. A clean verdict now gets the configured lifetime only when every provider actually answered; otherwise it is kept for five minutes, which still absorbs a burst of logins. Flagged verdicts are unaffected, and so is a round that stopped early because the score was already reached. `/proxyshield clearcache` empties both the in-memory cache and the stored one, which is the supported way to force a re-check. Config files from 2.4 and 2.5.0 work unchanged.

## Fixed Five defects that let a commercial VPN connect unflagged. They compound: with the shipped configuration, four of six real ProtonVPN exits passed every check. All six are stopped now, and ten consumer ISP and mobile addresses across seven countries still connect. **`business` counted as a residential connection.** `detection.allow-residential-hosting` therefore waved every VPN operator past the hosting block. In iplocate's vocabulary a home line is `isp`, a datacenter is `hosting`, and `business` is a corporate network, which is exactly what a VPN company announcing its own ASN looks like. The exemption now covers residential, mobile, cellular and `isp` only. **The reverse DNS check found no name for any VPN exit.** It went through `InetAddress.getCanonicalHostName()`, which performs a forward confirmed reverse lookup and discards the PTR unless the name it returns resolves back to the same address. VPN operators routinely publish a PTR with no matching A record, so the JDK handed back the literal, which reads as "no PTR at all". Every ProtonVPN exit answers `185-70-41-1.protonmail.ch` to `dig` and that name has no A record. The PTR is now read directly, with the JDK call kept as a fallback. The DNS context is built once rather than per query, which is what kept the first lookup inside the 700 ms budget. **The one built-in rDNS pattern aimed at Proton never matched Proton.** The list carried `protonvpn`; Proton names its exits after the mail brand. Of the seventeen ranges Proton announces, ten publish a PTR and none matched. `protonmail` is in the list now, and `hosted` joins `hosting` because `hosted-by-<name>.net` is a common shape the longer word does not cover. **`ipapi-is` failed on every request and said so nowhere.** It is the highest weighted provider in the shipped configuration at 1.5, and without a key ipapi.is answers on its anonymous tier: eleven flat keys, none of the risk fields, `company` and `asn` as plain strings rather than objects. Every documented path found nothing, so it returned `response carried none of the expected fields` every time and silently contributed zero. It now reads that shape too, so an unkeyed install still gets the country, the ISP and the network from it. It still cannot judge a VPN without a key, so the first time any provider answers without a single risk field the console says which one, what it costs and what to do. **A clean verdict from an incomplete round was cached for six hours.** One provider answering "not a proxy" is enough to settle a consensus round, so a rate limit or a timeout on the single provider that would have flagged the address produced a clean answer that sat in the cache for the full `api.cache-minutes` and survived restarts through `lookup-cache.json`. A clean verdict now gets the configured lifetime only when every provider actually answered; otherwise it is kept for five minutes, which still absorbs a burst of logins. Flagged verdicts are unaffected, and so is a round that stopped early because the score was already reached. `/proxyshield clearcache` empties both the in-memory cache and the stored one, which is the supported way to force a re-check. Config files from 2.4 and 2.5.0 work unchanged.

## Fixed Five defects that let a commercial VPN connect unflagged. They compound: with the shipped configuration, four of six real ProtonVPN exits passed every check. All six are stopped now, and ten consumer ISP and mobile addresses across seven countries still connect. **`business` counted as a residential connection.** `detection.allow-residential-hosting` therefore waved every VPN operator past the hosting block. In iplocate's vocabulary a home line is `isp`, a datacenter is `hosting`, and `business` is a corporate network, which is exactly what a VPN company announcing its own ASN looks like. The exemption now covers residential, mobile, cellular and `isp` only. **The reverse DNS check found no name for any VPN exit.** It went through `InetAddress.getCanonicalHostName()`, which performs a forward confirmed reverse lookup and discards the PTR unless the name it returns resolves back to the same address. VPN operators routinely publish a PTR with no matching A record, so the JDK handed back the literal, which reads as "no PTR at all". Every ProtonVPN exit answers `185-70-41-1.protonmail.ch` to `dig` and that name has no A record. The PTR is now read directly, with the JDK call kept as a fallback. The DNS context is built once rather than per query, which is what kept the first lookup inside the 700 ms budget. **The one built-in rDNS pattern aimed at Proton never matched Proton.** The list carried `protonvpn`; Proton names its exits after the mail brand. Of the seventeen ranges Proton announces, ten publish a PTR and none matched. `protonmail` is in the list now, and `hosted` joins `hosting` because `hosted-by-<name>.net` is a common shape the longer word does not cover. **`ipapi-is` failed on every request and said so nowhere.** It is the highest weighted provider in the shipped configuration at 1.5, and without a key ipapi.is answers on its anonymous tier: eleven flat keys, none of the risk fields, `company` and `asn` as plain strings rather than objects. Every documented path found nothing, so it returned `response carried none of the expected fields` every time and silently contributed zero. It now reads that shape too, so an unkeyed install still gets the country, the ISP and the network from it. It still cannot judge a VPN without a key, so the first time any provider answers without a single risk field the console says which one, what it costs and what to do. **A clean verdict from an incomplete round was cached for six hours.** One provider answering "not a proxy" is enough to settle a consensus round, so a rate limit or a timeout on the single provider that would have flagged the address produced a clean answer that sat in the cache for the full `api.cache-minutes` and survived restarts through `lookup-cache.json`. A clean verdict now gets the configured lifetime only when every provider actually answered; otherwise it is kept for five minutes, which still absorbs a burst of logins. Flagged verdicts are unaffected, and so is a round that stopped early because the score was already reached. `/proxyshield clearcache` empties both the in-memory cache and the stored one, which is the supported way to force a re-check. Config files from 2.4 and 2.5.0 work unchanged.

## Fixed Five defects that let a commercial VPN connect unflagged. They compound: with the shipped configuration, four of six real ProtonVPN exits passed every check. All six are stopped now, and ten consumer ISP and mobile addresses across seven countries still connect. **`business` counted as a residential connection.** `detection.allow-residential-hosting` therefore waved every VPN operator past the hosting block. In iplocate's vocabulary a home line is `isp`, a datacenter is `hosting`, and `business` is a corporate network, which is exactly what a VPN company announcing its own ASN looks like. The exemption now covers residential, mobile, cellular and `isp` only. **The reverse DNS check found no name for any VPN exit.** It went through `InetAddress.getCanonicalHostName()`, which performs a forward confirmed reverse lookup and discards the PTR unless the name it returns resolves back to the same address. VPN operators routinely publish a PTR with no matching A record, so the JDK handed back the literal, which reads as "no PTR at all". Every ProtonVPN exit answers `185-70-41-1.protonmail.ch` to `dig` and that name has no A record. The PTR is now read directly, with the JDK call kept as a fallback. The DNS context is built once rather than per query, which is what kept the first lookup inside the 700 ms budget. **The one built-in rDNS pattern aimed at Proton never matched Proton.** The list carried `protonvpn`; Proton names its exits after the mail brand. Of the seventeen ranges Proton announces, ten publish a PTR and none matched. `protonmail` is in the list now, and `hosted` joins `hosting` because `hosted-by-<name>.net` is a common shape the longer word does not cover. **`ipapi-is` failed on every request and said so nowhere.** It is the highest weighted provider in the shipped configuration at 1.5, and without a key ipapi.is answers on its anonymous tier: eleven flat keys, none of the risk fields, `company` and `asn` as plain strings rather than objects. Every documented path found nothing, so it returned `response carried none of the expected fields` every time and silently contributed zero. It now reads that shape too, so an unkeyed install still gets the country, the ISP and the network from it. It still cannot judge a VPN without a key, so the first time any provider answers without a single risk field the console says which one, what it costs and what to do. **A clean verdict from an incomplete round was cached for six hours.** One provider answering "not a proxy" is enough to settle a consensus round, so a rate limit or a timeout on the single provider that would have flagged the address produced a clean answer that sat in the cache for the full `api.cache-minutes` and survived restarts through `lookup-cache.json`. A clean verdict now gets the configured lifetime only when every provider actually answered; otherwise it is kept for five minutes, which still absorbs a burst of logins. Flagged verdicts are unaffected, and so is a round that stopped early because the score was already reached. `/proxyshield clearcache` empties both the in-memory cache and the stored one, which is the supported way to force a re-check. Config files from 2.4 and 2.5.0 work unchanged.

## Added **One jar for every platform:** `ProxyShield-Universal-2.5.0.jar` It carries all four entry points and all four plugin descriptors, and each server reads the one it knows. Bukkit takes `plugin.yml`, BungeeCord takes `bungee.yml` ahead of it, Velocity takes `velocity-plugin.json` and Sponge takes `META-INF/sponge_plugins.json`. The same file drops into a Paper `plugins/` folder, a BungeeCord one, a Velocity one or a Sponge `mods/` folder. It is an extra download, not a replacement. The five per-platform jars are unchanged and remain the plainer choice for a single server. The universal one saves a network running several of them from fetching four files that differ in about a hundred classes. Nothing in the plugin behaves differently. It costs roughly 400 KB over a single-platform jar, almost all of it the bundled YAML parser that Velocity and Sponge need and Bukkit does not. Tested on Folia 1.21.11, BungeeCord, Velocity 3.5.1 and SpongeVanilla API 17. Each loaded and enabled the same file with no exceptions. Config files from 2.4 work unchanged.

## Fixed **The address count in the startup log was always the same number.** Every start reported `covering 9223372036854775807 addresses`, which is `Long.MAX_VALUE` and reads like a broken counter. It was not arithmetic going wrong: the total saturated on purpose, but a single IPv6 `/64` already holds 2^64 addresses, so with the default feeds the guard tripped on the first IPv6 range every time. The figure never moved with its input, which is the giveaway that it was measuring nothing. There is no combined total any more, because no `long` can hold one. IPv4 is counted exactly and IPv6 is reported by range: ``` VPN lists ready: 65295 entries compiled into 36349 ranges. IPv4: 31078 ranges covering 392968591 addresses. IPv6: 5271 ranges. ``` The `{addresses}` placeholder in `refresh-done` is IPv4 only and both message files say so. Config files from 2.4.0 work unchanged.

## Fixed **The address count in the startup log was always the same number.** Every start reported `covering 9223372036854775807 addresses`, which is `Long.MAX_VALUE` and reads like a broken counter. It was not arithmetic going wrong: the total saturated on purpose, but a single IPv6 `/64` already holds 2^64 addresses, so with the default feeds the guard tripped on the first IPv6 range every time. The figure never moved with its input, which is the giveaway that it was measuring nothing. There is no combined total any more, because no `long` can hold one. IPv4 is counted exactly and IPv6 is reported by range: ``` VPN lists ready: 65295 entries compiled into 36349 ranges. IPv4: 31078 ranges covering 392968591 addresses. IPv6: 5271 ranges. ``` The `{addresses}` placeholder in `refresh-done` is IPv4 only and both message files say so. Config files from 2.4.0 work unchanged.

## Fixed **The address count in the startup log was always the same number.** Every start reported `covering 9223372036854775807 addresses`, which is `Long.MAX_VALUE` and reads like a broken counter. It was not arithmetic going wrong: the total saturated on purpose, but a single IPv6 `/64` already holds 2^64 addresses, so with the default feeds the guard tripped on the first IPv6 range every time. The figure never moved with its input, which is the giveaway that it was measuring nothing. There is no combined total any more, because no `long` can hold one. IPv4 is counted exactly and IPv6 is reported by range: ``` VPN lists ready: 65295 entries compiled into 36349 ranges. IPv4: 31078 ranges covering 392968591 addresses. IPv6: 5271 ranges. ``` The `{addresses}` placeholder in `refresh-done` is IPv4 only and both message files say so. Config files from 2.4.0 work unchanged.

## Fixed **The address count in the startup log was always the same number.** Every start reported `covering 9223372036854775807 addresses`, which is `Long.MAX_VALUE` and reads like a broken counter. It was not arithmetic going wrong: the total saturated on purpose, but a single IPv6 `/64` already holds 2^64 addresses, so with the default feeds the guard tripped on the first IPv6 range every time. The figure never moved with its input, which is the giveaway that it was measuring nothing. There is no combined total any more, because no `long` can hold one. IPv4 is counted exactly and IPv6 is reported by range: ``` VPN lists ready: 65295 entries compiled into 36349 ranges. IPv4: 31078 ranges covering 392968591 addresses. IPv6: 5271 ranges. ``` The `{addresses}` placeholder in `refresh-done` is IPv4 only and both message files say so. Config files from 2.4.0 work unchanged.

## Fixed **The address count in the startup log was always the same number.** Every start reported `covering 9223372036854775807 addresses`, which is `Long.MAX_VALUE` and reads like a broken counter. It was not arithmetic going wrong: the total saturated on purpose, but a single IPv6 `/64` already holds 2^64 addresses, so with the default feeds the guard tripped on the first IPv6 range every time. The figure never moved with its input, which is the giveaway that it was measuring nothing. There is no combined total any more, because no `long` can hold one. IPv4 is counted exactly and IPv6 is reported by range: ``` VPN lists ready: 65295 entries compiled into 36349 ranges. IPv4: 31078 ranges covering 392968591 addresses. IPv6: 5271 ranges. ``` The `{addresses}` placeholder in `refresh-done` is IPv4 only and both message files say so. Config files from 2.4.0 work unchanged.

## Added **The Discord embed layout is now yours to write** (`discord.embed`). The message used to be fixed at a title and six inline boxes. Every visible part is a template string instead: ```yaml discord: embed: title: "`{player}`" description: | ```ansi IP: `{ip}` Country: {country} Action: {action} ``` thumbnail: "https://your-server.example/alert.gif" footer: "ProxyShield {version} on {platform}" fields: {} ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{platform}` `{version}`, plus `{action}` (`Connection denied` / `Logged only (dry run)`) and `{action_id}` (`kicked` / `allowed`). Fields are named entries rather than a list, the same way `api.providers` works, and appear in the order written. Clear them with `fields: {}` for a description-only message. Values go in exactly as written, so the backticks are yours to place. Discord parses embed text as Markdown and an underscore is a legal Minecraft name character, so the shipped layout wraps everything that can contain one. **Nothing changes for an existing server.** A config without an `embed` section renders the previous layout, and the section now shipped in `config.yml` is that same layout spelled out, which a test pins. The thumbnail must be `https://`, the same rule the webhook URL is held to. Also added: `{action_id}` in `actions.on-flag`, so one name means one thing in both the commands and the embed.

## Added **The Discord embed layout is now yours to write** (`discord.embed`). The message used to be fixed at a title and six inline boxes. Every visible part is a template string instead: ```yaml discord: embed: title: "`{player}`" description: | ```ansi IP: `{ip}` Country: {country} Action: {action} ``` thumbnail: "https://your-server.example/alert.gif" footer: "ProxyShield {version} on {platform}" fields: {} ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{platform}` `{version}`, plus `{action}` (`Connection denied` / `Logged only (dry run)`) and `{action_id}` (`kicked` / `allowed`). Fields are named entries rather than a list, the same way `api.providers` works, and appear in the order written. Clear them with `fields: {}` for a description-only message. Values go in exactly as written, so the backticks are yours to place. Discord parses embed text as Markdown and an underscore is a legal Minecraft name character, so the shipped layout wraps everything that can contain one. **Nothing changes for an existing server.** A config without an `embed` section renders the previous layout, and the section now shipped in `config.yml` is that same layout spelled out, which a test pins. The thumbnail must be `https://`, the same rule the webhook URL is held to. Also added: `{action_id}` in `actions.on-flag`, so one name means one thing in both the commands and the embed.

## Added **The Discord embed layout is now yours to write** (`discord.embed`). The message used to be fixed at a title and six inline boxes. Every visible part is a template string instead: ```yaml discord: embed: title: "`{player}`" description: | ```ansi IP: `{ip}` Country: {country} Action: {action} ``` thumbnail: "https://your-server.example/alert.gif" footer: "ProxyShield {version} on {platform}" fields: {} ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{platform}` `{version}`, plus `{action}` (`Connection denied` / `Logged only (dry run)`) and `{action_id}` (`kicked` / `allowed`). Fields are named entries rather than a list, the same way `api.providers` works, and appear in the order written. Clear them with `fields: {}` for a description-only message. Values go in exactly as written, so the backticks are yours to place. Discord parses embed text as Markdown and an underscore is a legal Minecraft name character, so the shipped layout wraps everything that can contain one. **Nothing changes for an existing server.** A config without an `embed` section renders the previous layout, and the section now shipped in `config.yml` is that same layout spelled out, which a test pins. The thumbnail must be `https://`, the same rule the webhook URL is held to. Also added: `{action_id}` in `actions.on-flag`, so one name means one thing in both the commands and the embed.

## Added **The Discord embed layout is now yours to write** (`discord.embed`). The message used to be fixed at a title and six inline boxes. Every visible part is a template string instead: ```yaml discord: embed: title: "`{player}`" description: | ```ansi IP: `{ip}` Country: {country} Action: {action} ``` thumbnail: "https://your-server.example/alert.gif" footer: "ProxyShield {version} on {platform}" fields: {} ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{platform}` `{version}`, plus `{action}` (`Connection denied` / `Logged only (dry run)`) and `{action_id}` (`kicked` / `allowed`). Fields are named entries rather than a list, the same way `api.providers` works, and appear in the order written. Clear them with `fields: {}` for a description-only message. Values go in exactly as written, so the backticks are yours to place. Discord parses embed text as Markdown and an underscore is a legal Minecraft name character, so the shipped layout wraps everything that can contain one. **Nothing changes for an existing server.** A config without an `embed` section renders the previous layout, and the section now shipped in `config.yml` is that same layout spelled out, which a test pins. The thumbnail must be `https://`, the same rule the webhook URL is held to. Also added: `{action_id}` in `actions.on-flag`, so one name means one thing in both the commands and the embed.

## Added **The Discord embed layout is now yours to write** (`discord.embed`). The message used to be fixed at a title and six inline boxes. Every visible part is a template string instead: ```yaml discord: embed: title: "`{player}`" description: | ```ansi IP: `{ip}` Country: {country} Action: {action} ``` thumbnail: "https://your-server.example/alert.gif" footer: "ProxyShield {version} on {platform}" fields: {} ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{platform}` `{version}`, plus `{action}` (`Connection denied` / `Logged only (dry run)`) and `{action_id}` (`kicked` / `allowed`). Fields are named entries rather than a list, the same way `api.providers` works, and appear in the order written. Clear them with `fields: {}` for a description-only message. Values go in exactly as written, so the backticks are yours to place. Discord parses embed text as Markdown and an underscore is a legal Minecraft name character, so the shipped layout wraps everything that can contain one. **Nothing changes for an existing server.** A config without an `embed` section renders the previous layout, and the section now shipped in `config.yml` is that same layout spelled out, which a test pins. The thumbnail must be `https://`, the same rule the webhook URL is held to. Also added: `{action_id}` in `actions.on-flag`, so one name means one thing in both the commands and the embed.

## Added **Console commands on a detection** (`actions.on-flag`). Not every server wants a flagged player gone. Some would rather mark them: drop them into a restricted group, make them verify through Discord, hand the name to another plugin. That is now a list of console commands. ```yaml actions: on-flag: - "lp user {player} permission set myserver.vpnflagged true" - "webhook {player} flagged {reason} from {ip}" delay-seconds: 3 run-when: always ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{reason_id}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{action}` `{platform}`. The leading slash is optional. Combined with `detection.dry-run: true` this is the flag-instead-of-kick setup: the detection fires, the alert and the webhook go out, the commands run, and the player stays connected. `delay-seconds` matters because a connection is judged before the player is on the server. At `0` the commands run while they are still connecting, which suits a permission grant but not anything that needs them online. `run-when` takes `always`, `kicked` or `allowed`. ## Fixed - **Clearing `discord.username` or `discord.title` broke the webhook entirely**, with every alert rejected as `HTTP 400`. Both are now left out of the payload when blank instead of sent as `""`. - **Underscores in a player name were eaten by Discord's Markdown.** `Some_Name` arrived italic and `__Name__` underlined, so staff searched for a name that was never sent. The name, address and ISP now go out as code spans. - **Providers answering with a redirect were treated as failures.** Up to three hops are now followed. - **A keyed service left enabled without a key was asked with an empty key.** The parameter is now dropped from the URL entirely.

## Added **Console commands on a detection** (`actions.on-flag`). Not every server wants a flagged player gone. Some would rather mark them: drop them into a restricted group, make them verify through Discord, hand the name to another plugin. That is now a list of console commands. ```yaml actions: on-flag: - "lp user {player} permission set myserver.vpnflagged true" - "webhook {player} flagged {reason} from {ip}" delay-seconds: 3 run-when: always ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{reason_id}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{action}` `{platform}`. The leading slash is optional. Combined with `detection.dry-run: true` this is the flag-instead-of-kick setup: the detection fires, the alert and the webhook go out, the commands run, and the player stays connected. `delay-seconds` matters because a connection is judged before the player is on the server. At `0` the commands run while they are still connecting, which suits a permission grant but not anything that needs them online. `run-when` takes `always`, `kicked` or `allowed`. ## Fixed - **Clearing `discord.username` or `discord.title` broke the webhook entirely**, with every alert rejected as `HTTP 400`. Both are now left out of the payload when blank instead of sent as `""`. - **Underscores in a player name were eaten by Discord's Markdown.** `Some_Name` arrived italic and `__Name__` underlined, so staff searched for a name that was never sent. The name, address and ISP now go out as code spans. - **Providers answering with a redirect were treated as failures.** Up to three hops are now followed. - **A keyed service left enabled without a key was asked with an empty key.** The parameter is now dropped from the URL entirely.

## Added **Console commands on a detection** (`actions.on-flag`). Not every server wants a flagged player gone. Some would rather mark them: drop them into a restricted group, make them verify through Discord, hand the name to another plugin. That is now a list of console commands. ```yaml actions: on-flag: - "lp user {player} permission set myserver.vpnflagged true" - "webhook {player} flagged {reason} from {ip}" delay-seconds: 3 run-when: always ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{reason_id}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{action}` `{platform}`. The leading slash is optional. Combined with `detection.dry-run: true` this is the flag-instead-of-kick setup: the detection fires, the alert and the webhook go out, the commands run, and the player stays connected. `delay-seconds` matters because a connection is judged before the player is on the server. At `0` the commands run while they are still connecting, which suits a permission grant but not anything that needs them online. `run-when` takes `always`, `kicked` or `allowed`. ## Fixed - **Clearing `discord.username` or `discord.title` broke the webhook entirely**, with every alert rejected as `HTTP 400`. Both are now left out of the payload when blank instead of sent as `""`. - **Underscores in a player name were eaten by Discord's Markdown.** `Some_Name` arrived italic and `__Name__` underlined, so staff searched for a name that was never sent. The name, address and ISP now go out as code spans. - **Providers answering with a redirect were treated as failures.** Up to three hops are now followed. - **A keyed service left enabled without a key was asked with an empty key.** The parameter is now dropped from the URL entirely.

## Added **Console commands on a detection** (`actions.on-flag`). Not every server wants a flagged player gone. Some would rather mark them: drop them into a restricted group, make them verify through Discord, hand the name to another plugin. That is now a list of console commands. ```yaml actions: on-flag: - "lp user {player} permission set myserver.vpnflagged true" - "webhook {player} flagged {reason} from {ip}" delay-seconds: 3 run-when: always ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{reason_id}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{action}` `{platform}`. The leading slash is optional. Combined with `detection.dry-run: true` this is the flag-instead-of-kick setup: the detection fires, the alert and the webhook go out, the commands run, and the player stays connected. `delay-seconds` matters because a connection is judged before the player is on the server. At `0` the commands run while they are still connecting, which suits a permission grant but not anything that needs them online. `run-when` takes `always`, `kicked` or `allowed`. ## Fixed - **Clearing `discord.username` or `discord.title` broke the webhook entirely**, with every alert rejected as `HTTP 400`. Both are now left out of the payload when blank instead of sent as `""`. - **Underscores in a player name were eaten by Discord's Markdown.** `Some_Name` arrived italic and `__Name__` underlined, so staff searched for a name that was never sent. The name, address and ISP now go out as code spans. - **Providers answering with a redirect were treated as failures.** Up to three hops are now followed. - **A keyed service left enabled without a key was asked with an empty key.** The parameter is now dropped from the URL entirely.

## Added **Console commands on a detection** (`actions.on-flag`). Not every server wants a flagged player gone. Some would rather mark them: drop them into a restricted group, make them verify through Discord, hand the name to another plugin. That is now a list of console commands. ```yaml actions: on-flag: - "lp user {player} permission set myserver.vpnflagged true" - "webhook {player} flagged {reason} from {ip}" delay-seconds: 3 run-when: always ``` Placeholders: `{player}` `{uuid}` `{ip}` `{reason}` `{reason_id}` `{country}` `{isp}` `{asn}` `{score}` `{sources}` `{action}` `{platform}`. The leading slash is optional. Combined with `detection.dry-run: true` this is the flag-instead-of-kick setup: the detection fires, the alert and the webhook go out, the commands run, and the player stays connected. `delay-seconds` matters because a connection is judged before the player is on the server. At `0` the commands run while they are still connecting, which suits a permission grant but not anything that needs them online. `run-when` takes `always`, `kicked` or `allowed`. ## Fixed - **Clearing `discord.username` or `discord.title` broke the webhook entirely**, with every alert rejected as `HTTP 400`. Both are now left out of the payload when blank instead of sent as `""`. - **Underscores in a player name were eaten by Discord's Markdown.** `Some_Name` arrived italic and `__Name__` underlined, so staff searched for a name that was never sent. The name, address and ISP now go out as code spans. - **Providers answering with a redirect were treated as failures.** Up to three hops are now followed. - **A keyed service left enabled without a key was asked with an empty key.** The parameter is now dropped from the URL entirely.

**The Bukkit builds of 2.2 refused to start without PlaceholderAPI installed.** If you are on 2.2, update. The check for PlaceholderAPI lived inside the expansion class itself. Reaching the check meant loading that class, loading it resolved its `PlaceholderExpansion` superclass, and that class does not exist on a server without PlaceholderAPI. The result was a `NoClassDefFoundError` during `onEnable` that took the whole plugin down — leaving the server with no proxy protection at all, which is the worst way for this particular plugin to fail. The guard now sits in the plugin's main class, before anything names the expansion, and the registration is additionally wrapped so an incompatible PlaceholderAPI version cannot stop the plugin either. Only the Paper and Folia builds of 2.2 were affected. BungeeCord, Velocity and Sponge never touched that code and are functionally unchanged in this release; they are rebuilt only to keep the version numbers in step. Everything else is 2.2: consensus scoring across 26 providers, ASN and reverse-DNS signals, behavioural heuristics, trust for regulars, and shared storage through MySQL, MariaDB, PostgreSQL, SQLite, H2 or Redis. See the 2.2 changelog for the details.

**The Bukkit builds of 2.2 refused to start without PlaceholderAPI installed.** If you are on 2.2, update. The check for PlaceholderAPI lived inside the expansion class itself. Reaching the check meant loading that class, loading it resolved its `PlaceholderExpansion` superclass, and that class does not exist on a server without PlaceholderAPI. The result was a `NoClassDefFoundError` during `onEnable` that took the whole plugin down — leaving the server with no proxy protection at all, which is the worst way for this particular plugin to fail. The guard now sits in the plugin's main class, before anything names the expansion, and the registration is additionally wrapped so an incompatible PlaceholderAPI version cannot stop the plugin either. Only the Paper and Folia builds of 2.2 were affected. BungeeCord, Velocity and Sponge never touched that code and are functionally unchanged in this release; they are rebuilt only to keep the version numbers in step. Everything else is 2.2: consensus scoring across 26 providers, ASN and reverse-DNS signals, behavioural heuristics, trust for regulars, and shared storage through MySQL, MariaDB, PostgreSQL, SQLite, H2 or Redis. See the 2.2 changelog for the details.

**The Bukkit builds of 2.2 refused to start without PlaceholderAPI installed.** If you are on 2.2, update. The check for PlaceholderAPI lived inside the expansion class itself. Reaching the check meant loading that class, loading it resolved its `PlaceholderExpansion` superclass, and that class does not exist on a server without PlaceholderAPI. The result was a `NoClassDefFoundError` during `onEnable` that took the whole plugin down — leaving the server with no proxy protection at all, which is the worst way for this particular plugin to fail. The guard now sits in the plugin's main class, before anything names the expansion, and the registration is additionally wrapped so an incompatible PlaceholderAPI version cannot stop the plugin either. Only the Paper and Folia builds of 2.2 were affected. BungeeCord, Velocity and Sponge never touched that code and are functionally unchanged in this release; they are rebuilt only to keep the version numbers in step. Everything else is 2.2: consensus scoring across 26 providers, ASN and reverse-DNS signals, behavioural heuristics, trust for regulars, and shared storage through MySQL, MariaDB, PostgreSQL, SQLite, H2 or Redis. See the 2.2 changelog for the details.

**The Bukkit builds of 2.2 refused to start without PlaceholderAPI installed.** If you are on 2.2, update. The check for PlaceholderAPI lived inside the expansion class itself. Reaching the check meant loading that class, loading it resolved its `PlaceholderExpansion` superclass, and that class does not exist on a server without PlaceholderAPI. The result was a `NoClassDefFoundError` during `onEnable` that took the whole plugin down — leaving the server with no proxy protection at all, which is the worst way for this particular plugin to fail. The guard now sits in the plugin's main class, before anything names the expansion, and the registration is additionally wrapped so an incompatible PlaceholderAPI version cannot stop the plugin either. Only the Paper and Folia builds of 2.2 were affected. BungeeCord, Velocity and Sponge never touched that code and are functionally unchanged in this release; they are rebuilt only to keep the version numbers in step. Everything else is 2.2: consensus scoring across 26 providers, ASN and reverse-DNS signals, behavioural heuristics, trust for regulars, and shared storage through MySQL, MariaDB, PostgreSQL, SQLite, H2 or Redis. See the 2.2 changelog for the details.

**The Bukkit builds of 2.2 refused to start without PlaceholderAPI installed.** If you are on 2.2, update. The check for PlaceholderAPI lived inside the expansion class itself. Reaching the check meant loading that class, loading it resolved its `PlaceholderExpansion` superclass, and that class does not exist on a server without PlaceholderAPI. The result was a `NoClassDefFoundError` during `onEnable` that took the whole plugin down — leaving the server with no proxy protection at all, which is the worst way for this particular plugin to fail. The guard now sits in the plugin's main class, before anything names the expansion, and the registration is additionally wrapped so an incompatible PlaceholderAPI version cannot stop the plugin either. Only the Paper and Folia builds of 2.2 were affected. BungeeCord, Velocity and Sponge never touched that code and are functionally unchanged in this release; they are rebuilt only to keep the version numbers in step. Everything else is 2.2: consensus scoring across 26 providers, ASN and reverse-DNS signals, behavioural heuristics, trust for regulars, and shared storage through MySQL, MariaDB, PostgreSQL, SQLite, H2 or Redis. See the 2.2 changelog for the details.

**Spigot support.** The Bukkit jar now runs on Paper, Purpur, Folia and plain Spigot. Async scheduling, disconnecting a player and sending a message go through a bridge chosen at start-up, so the Paper-only types are never loaded on a server that lacks them. **Bedrock players are exempt by default** (`whitelist.bedrock-players`). Wherever Geyser runs anywhere other than the player's own machine, the address ProxyShield sees is Geyser's — and a Geyser instance on rented hardware sits in exactly the datacenter ranges the feeds list. Without this a server would drop every single Bedrock player the moment hosting detection was switched on. Floodgate derives these UUIDs server side from the Xbox Live account, so a Java player cannot fake one to skip the check. **Lookup provider failover** (`api.providers`). Endpoints are tried in order, so a rate limited or unreachable provider costs one failed request instead of the whole check. Responses are understood in both the flat shape (ip-api.com) and the nested-by-address shape (proxycheck.io), including the field spellings proxy/vpn/tor/block, hosting/datacenter, countryCode/isocode, isp/provider/organisation and yes/no flags. `api.url` is superseded by `api.providers` and now defaults to empty. An existing `api.url` is still honoured as the first provider, but emptying the provider list now genuinely means "no provider" rather than silently falling back to a hardcoded endpoint. 124 automated tests, up from 111. Verified on Paper 1.21.11. Folia, Spigot, BungeeCord, Velocity and Sponge are built from the same core but have not been run on a live server yet.

**Spigot support.** The Bukkit jar now runs on Paper, Purpur, Folia and plain Spigot. Async scheduling, disconnecting a player and sending a message go through a bridge chosen at start-up, so the Paper-only types are never loaded on a server that lacks them. **Bedrock players are exempt by default** (`whitelist.bedrock-players`). Wherever Geyser runs anywhere other than the player's own machine, the address ProxyShield sees is Geyser's — and a Geyser instance on rented hardware sits in exactly the datacenter ranges the feeds list. Without this a server would drop every single Bedrock player the moment hosting detection was switched on. Floodgate derives these UUIDs server side from the Xbox Live account, so a Java player cannot fake one to skip the check. **Lookup provider failover** (`api.providers`). Endpoints are tried in order, so a rate limited or unreachable provider costs one failed request instead of the whole check. Responses are understood in both the flat shape (ip-api.com) and the nested-by-address shape (proxycheck.io), including the field spellings proxy/vpn/tor/block, hosting/datacenter, countryCode/isocode, isp/provider/organisation and yes/no flags. `api.url` is superseded by `api.providers` and now defaults to empty. An existing `api.url` is still honoured as the first provider, but emptying the provider list now genuinely means "no provider" rather than silently falling back to a hardcoded endpoint. 124 automated tests, up from 111. Verified on Paper 1.21.11. Folia, Spigot, BungeeCord, Velocity and Sponge are built from the same core but have not been run on a live server yet.

**Spigot support.** The Bukkit jar now runs on Paper, Purpur, Folia and plain Spigot. Async scheduling, disconnecting a player and sending a message go through a bridge chosen at start-up, so the Paper-only types are never loaded on a server that lacks them. **Bedrock players are exempt by default** (`whitelist.bedrock-players`). Wherever Geyser runs anywhere other than the player's own machine, the address ProxyShield sees is Geyser's — and a Geyser instance on rented hardware sits in exactly the datacenter ranges the feeds list. Without this a server would drop every single Bedrock player the moment hosting detection was switched on. Floodgate derives these UUIDs server side from the Xbox Live account, so a Java player cannot fake one to skip the check. **Lookup provider failover** (`api.providers`). Endpoints are tried in order, so a rate limited or unreachable provider costs one failed request instead of the whole check. Responses are understood in both the flat shape (ip-api.com) and the nested-by-address shape (proxycheck.io), including the field spellings proxy/vpn/tor/block, hosting/datacenter, countryCode/isocode, isp/provider/organisation and yes/no flags. `api.url` is superseded by `api.providers` and now defaults to empty. An existing `api.url` is still honoured as the first provider, but emptying the provider list now genuinely means "no provider" rather than silently falling back to a hardcoded endpoint. 124 automated tests, up from 111. Verified on Paper 1.21.11. Folia, Spigot, BungeeCord, Velocity and Sponge are built from the same core but have not been run on a live server yet.

**Spigot support.** The Bukkit jar now runs on Paper, Purpur, Folia and plain Spigot. Async scheduling, disconnecting a player and sending a message go through a bridge chosen at start-up, so the Paper-only types are never loaded on a server that lacks them. **Bedrock players are exempt by default** (`whitelist.bedrock-players`). Wherever Geyser runs anywhere other than the player's own machine, the address ProxyShield sees is Geyser's — and a Geyser instance on rented hardware sits in exactly the datacenter ranges the feeds list. Without this a server would drop every single Bedrock player the moment hosting detection was switched on. Floodgate derives these UUIDs server side from the Xbox Live account, so a Java player cannot fake one to skip the check. **Lookup provider failover** (`api.providers`). Endpoints are tried in order, so a rate limited or unreachable provider costs one failed request instead of the whole check. Responses are understood in both the flat shape (ip-api.com) and the nested-by-address shape (proxycheck.io), including the field spellings proxy/vpn/tor/block, hosting/datacenter, countryCode/isocode, isp/provider/organisation and yes/no flags. `api.url` is superseded by `api.providers` and now defaults to empty. An existing `api.url` is still honoured as the first provider, but emptying the provider list now genuinely means "no provider" rather than silently falling back to a hardcoded endpoint. 124 automated tests, up from 111. Verified on Paper 1.21.11. Folia, Spigot, BungeeCord, Velocity and Sponge are built from the same core but have not been run on a live server yet.

**Spigot support.** The Bukkit jar now runs on Paper, Purpur, Folia and plain Spigot. Async scheduling, disconnecting a player and sending a message go through a bridge chosen at start-up, so the Paper-only types are never loaded on a server that lacks them. **Bedrock players are exempt by default** (`whitelist.bedrock-players`). Wherever Geyser runs anywhere other than the player's own machine, the address ProxyShield sees is Geyser's — and a Geyser instance on rented hardware sits in exactly the datacenter ranges the feeds list. Without this a server would drop every single Bedrock player the moment hosting detection was switched on. Floodgate derives these UUIDs server side from the Xbox Live account, so a Java player cannot fake one to skip the check. **Lookup provider failover** (`api.providers`). Endpoints are tried in order, so a rate limited or unreachable provider costs one failed request instead of the whole check. Responses are understood in both the flat shape (ip-api.com) and the nested-by-address shape (proxycheck.io), including the field spellings proxy/vpn/tor/block, hosting/datacenter, countryCode/isocode, isp/provider/organisation and yes/no flags. `api.url` is superseded by `api.providers` and now defaults to empty. An existing `api.url` is still honoured as the first provider, but emptying the provider list now genuinely means "no provider" rather than silently falling back to a hardcoded endpoint. 124 automated tests, up from 111. Verified on Paper 1.21.11. Folia, Spigot, BungeeCord, Velocity and Sponge are built from the same core but have not been run on a live server yet.