Fixed

Five defects that let a commercial VPN connect unflagged. They compound: with the shipped configuration, four of six real ProtonVPN exits passed every check. All six are stopped now, and ten consumer ISP and mobile addresses across seven countries still connect.

business counted as a residential connection. detection.allow-residential-hosting therefore waved every VPN operator past the hosting block. In iplocate's vocabulary a home line is isp, a datacenter is hosting, and business is a corporate network, which is exactly what a VPN company announcing its own ASN looks like. The exemption now covers residential, mobile, cellular and isp only.

The reverse DNS check found no name for any VPN exit. It went through InetAddress.getCanonicalHostName(), which performs a forward confirmed reverse lookup and discards the PTR unless the name it returns resolves back to the same address. VPN operators routinely publish a PTR with no matching A record, so the JDK handed back the literal, which reads as "no PTR at all". Every ProtonVPN exit answers 185-70-41-1.protonmail.ch to dig and that name has no A record. The PTR is now read directly, with the JDK call kept as a fallback. The DNS context is built once rather than per query, which is what kept the first lookup inside the 700 ms budget.

The one built-in rDNS pattern aimed at Proton never matched Proton. The list carried protonvpn; Proton names its exits after the mail brand. Of the seventeen ranges Proton announces, ten publish a PTR and none matched. protonmail is in the list now, and hosted joins hosting because hosted-by-<name>.net is a common shape the longer word does not cover.

ipapi-is failed on every request and said so nowhere. It is the highest weighted provider in the shipped configuration at 1.5, and without a key ipapi.is answers on its anonymous tier: eleven flat keys, none of the risk fields, company and asn as plain strings rather than objects. Every documented path found nothing, so it returned response carried none of the expected fields every time and silently contributed zero. It now reads that shape too, so an unkeyed install still gets the country, the ISP and the network from it. It still cannot judge a VPN without a key, so the first time any provider answers without a single risk field the console says which one, what it costs and what to do.

A clean verdict from an incomplete round was cached for six hours. One provider answering "not a proxy" is enough to settle a consensus round, so a rate limit or a timeout on the single provider that would have flagged the address produced a clean answer that sat in the cache for the full api.cache-minutes and survived restarts through lookup-cache.json. A clean verdict now gets the configured lifetime only when every provider actually answered; otherwise it is kept for five minutes, which still absorbs a burst of logins. Flagged verdicts are unaffected, and so is a round that stopped early because the score was already reached.

/proxyshield clearcache empties both the in-memory cache and the stored one, which is the supported way to force a re-check.

Config files from 2.4 and 2.5.0 work unchanged.

Hangar carries the three per-platform jars. The universal jar, one file for every platform, is on Modrinth and Codeberg, since Hangar takes one file per platform.