LXVPN - Advanced Anti VPN | Velocity + Bungee | Bot & TOR Pr

Changelog All notable changes to LXVPN. 1.0-BETA — 2026-07-22 A rewrite rather than an increment. The plugin was restructured so that one jar can serve both proxies without maintaining two copies of the logic, and the anti-VPN engine was replaced with the scoring model developed in LuminShield. LuminShield is a separate paid plugin of ours on BuiltByBit, not yet released. LXVPN stays free and stays anti-VPN only; the two share ideas, not a licence. This is a beta, and the label is accurate. It has been tested on Velocity. The BungeeCord side runs the same core and the same checks, but has not had a test pass yet. Run it on BungeeCord if you are willing to report what breaks; do not run it on a production BungeeCord network you cannot afford to have misbehave. Reports from either proxy are what turn this into 1.0. Read the migration section below before updating. The configuration format changed, and the old file will not carry over. Added · Velocity support. 0.3.3-APLHA was BungeeCord only. Both proxies are now supported from one jar, and both run identical checks because both call the same core — a fix on one is a fix on both, and neither can quietly fall behind. · Tiered scoring engine. Seven levels of reputation sources, each contributing points toward a threshold rather than deciding on its own. · Local ASN datacenter detection via GeoLite2-ASN, downloaded on first start. No API key, no rate limit, no outbound request while a player waits. · Local country filtering via GeoLite2-Country, in blacklist or whitelist mode. Replaces the old country list, which had no database behind it. · Per-account IP binding (/lxvpn iprestrict), with CIDR range support. · Virtual threads for all blocking I/O on Java 21 or newer, detected at runtime so Java 17 continues to work. · /lxvpn check <ip|player> — scores an address immediately, bypassing the cache, since the reason to run it is usually disagreeing with a cached verdict. · Discord webhook notifications, with the final octet of the address masked. · Tab completion on both proxies. · File logging to logs/lxvpn.log, with writes queued off the connection path. · Update checker that names both the running and the newest version. Changed · Package renamed from com.titanius.lxantivpn to com.titanius.lxvpn. · Version scheme. 0.3.3-APLHA (sic) is superseded by 1.0-BETA. The typo in the old tag is preserved here so it can still be found; it is not carried forward. · Configuration restructured — see the migration section below. · Permission node is now lxvpn.admin, was lxvpn.command. · Command aliases are now /lxvpn, /antivpn, /lxantivpn. The joke aliases (delusionalvpn, deluluvpn) are gone. · Blocking is now a score threshold, not any single source saying "proxy". Free reputation APIs disagree with each other constantly, and a plugin that blocks on one of them refuses real players every week. · Every source fails to zero. A provider being down, slow or rate limited reduces accuracy; it never blocks a login and never denies one. · Hard timeout on the verdict. A frozen connecting screen is a worse outcome than an unchecked VPN user. · Shaded dependencies are relocated. SnakeYAML, Jackson, MaxMind and org.json all move under com.titanius.lxvpn.libs. One jar loads next to arbitrary other plugins on two proxies, and an unrelocated SnakeYAML is the classic way to break a server that was working before this was installed. · JSON files are written atomically — to a temporary file, then moved. A crash mid-write previously left a truncated allow list, which locks every restricted account out on the next start. Removed · The bundled IP databases. ipdb4.json, protonvpn.json, anonymusprivacydatabase.json, ips.json and ip-blacklist.json are gone from the jar, and nothing looks for them any more. They were most of the download size and were frozen at build time: an address that changed hands stayed wrong until someone published a new release. The equivalent data now comes from lists fetched and refreshed at runtime. · Anti-bot settings. antibot: true no longer exists. That work lives in LuminShield, which grew out of this codebase; LXVPN is anti-VPN and nothing else. Two plugins on different schedules beats one plugin a network has to take whole. · connection-threshold. It was rate limiting, which is an anti-bot concern. Fixed · Login checks no longer run on a proxy thread. Both platform listeners hold the connection asynchronously — Velocity through EventTask.resumeWhenComplete, BungeeCord through login intents — so a slow provider costs one player's join time rather than the proxy's. · The BungeeCord intent is completed in a finally block. A missed completion leaves the player stuck on the connecting screen indefinitely. · List refreshes that return nothing no longer overwrite a good cached list. A mirror being briefly down previously disabled that check silently until the next refresh. · The score cache is bounded as well as time-expiring. A flood presenting tens of thousands of distinct addresses previously grew it without limit. · Malformed CIDR entries no longer throw. One typo excludes one entry instead of stopping startup. Security and privacy · Webhook notifications mask the last octet. A Discord channel is one screenshot away from being public, and a full address is personal data in most of Europe. · The GeoLite2 databases come from public redistributions. No MaxMind account or licence key is involved, because a setup step requiring registration with a third party is a setup step most people never finish. Known gaps in this beta · BungeeCord is untested, as noted above. · Nothing has been run against a real botnet flood. The load paths are designed for it — bounded caches, coalesced writes, suspendable outbound lookups — but designed for is not the same as measured under. · The update checker compares 1.0-BETA as 1.0, so a future 1.0 release will not be announced as newer. That is a known limitation of the version comparison, not an oversight in the release. Migrating from 0.3.3-APLHA Delete the old config.yml and let the plugin write a fresh one. The key names changed enough that editing in place is slower than starting over. Old key New key Note antivpn: true antivpn.enabled antibot: true — removed; use LuminShield tor: true — folded into check levels 1 and 2 antivpn_tor.checklevels antivpn.checklevels same numbering antivpn_tor.database_checks antivpn.database-checks now gates remote lists, not bundled files antivpn_tor.vpn-api-api-key antivpn.api-keys.vpnapi antivpn_tor.ipregistry-api-key antivpn.api-keys.ipregistry blocked-countries geo.countries + geo.enabled: true now needs a database, downloaded automatically bypass-list bypass CIDR ranges now accepted connection-threshold — removed players: /lxvpn iprestrict add moved to ip-restrictions.json, managed by command — antivpn.min-score new, and the setting most worth tuning blacklist.json carries over unchanged. Permissions need updating: lxvpn.command becomes lxvpn.admin. After updating · Start the proxy and watch for the ASN database download line. Until it appears, datacenter detection — the strongest signal here — is not running. · Run /lxvpn and check that the level summary matches what you expect. · Run /lxvpn check <your own ip> and confirm it comes back clean. If your own connection scores at or above the threshold, fix that before anything else. · Leave min-score at 2 for a week before deciding it is wrong. 0.3.3-APLHA The last release before 1.0-BETA. BungeeCord only. Bundled IP databases read from inside the jar. Blocking decided by individual sources rather than an aggregate score. Kept here for reference; not supported. 0.3.2-APLHA and earlier Bungee