Provider identity mismatches are a documented risk: one reviewed provider (SSONE) displays the domain hello-ssone.com but its registration links to flybit6202.com. Resolving such domain-identity mismatches before entering credentials or paying is flagged as a required evaluation step.

Clash-family proxy clients carry specific leak vectors distinct from VPNs: DNS leaks, IPv6 leaks, TUN-mode misconfiguration, rule-set bypass, and application-layer exclusions. Subscription URLs are equivalent to credentials and must be kept private; rotating a URL without evidence of a leak does not mitigate operator-level risk.

§4.2, §5.3, §5.5 defense

Subscription endpoints, node lists, and client configurations require ongoing updates to remain functional against evolving blocking, but accepting automatic configuration updates introduces supply-chain risk. Open-source code makes inspection possible but does not prove the binary matches the source, that an audit was performed, or that the server follows its stated policy.

§3.2, §4.6 deployment

Traditional VPN and proxy protocols can both be detected, blocked, rate-limited, or disrupted by mainland network controls. Newer transport or obfuscation layers do not guarantee resistance; no client category is inherently undetectable, faster, lighter, or safer.

§4.4 detection

An encrypted proxy (Shadowsocks, Trojan, VMess) protects only the client-to-server segment; traffic from the proxy server to a non-HTTPS destination may be readable on the onward path. Applications not covered by system-proxy, TUN, or routing rules connect directly, bypassing the tunnel entirely.

§1.1 defense