Nabzclan App Store - important updates 03/25/2026

[polo]

Hey everyone,

We've been working on some important changes to the App Store download system over the past few days. As some of you might have noticed, our hosting provider flagged us for excessive bandwidth usage which was causing slowdowns for everyone. To keep things running smoothly and make sure we can continue offering fast download speeds, we had to put some new systems in place.

Here's what changed:

Download Speed Tiers
- Guest users (not signed in) are now limited to 1 MB/s downloads and 50 downloads per hour. We know this is a bit slower than before, but it was necessary to cut down on the abuse we were seeing from bots and scrapers hammering our servers.
- Free members still get full speed downloads with a 5GB monthly bandwidth allowance. Once you hit that, speeds drop to 2 MB/s for the rest of the month — you can still download as much as you want though.
- VIP members are completely unaffected. Unlimited speed, unlimited bandwidth, same as always.


Rate Limiting for Guests
- We added a 50 downloads per hour limit for guest users. This was the main thing killing our server resources. A handful of IPs were downloading hundreds of files per hour with no account, which is obviously not normal usage. If you're a regular user this limit won't affect you at all — just sign in and you're good.


Why we did this
Honestly, we had to. The server abuse was getting out of hand and our hosting provider was not happy about it. These changes let us keep offering fast speeds to actual users while cutting off the people who were ruining it for everyone. The alternative was slower speeds across the board or higher costs that we'd have to pass on, and we didn't want either of those.

A Note for Sideloading App Developers & Self-Hosters​

If you're running a sideloading app or service that pulls from our repo, heads up — if your server is making all the download requests on behalf of your users, every download comes from your server's IP. That means your one IP will hit the guest rate limit (50/hour) pretty fast and your users will start getting blocked.

You have two options to avoid this:

Option 1: Pass the user's real IP
When your server proxies a download request for a user, forward their real IP address using the X-Forwarded-For header. Our system will use that instead of your server's IP for rate limiting.

Example (PHP - cURL):

$userIp = $_SERVER['REMOTE_ADDR']; // The real user's IP
$downloadUrl = "https://appstore.nabzclan.vip/download-repo-source/1978";

$ch = curl_init($downloadUrl);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-Forwarded-For: ' . $userIp,
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$fileData = curl_exec($ch);
curl_close($ch);

Example (Python - requests):

import requests

user_ip = request.remote_addr  # The real user's IP
download_url = "https://appstore.nabzclan.vip/download-repo-source/1978"

response = requests.get(download_url, headers={
    "X-Forwarded-For": user_ip,
})

Example (Node.js - fetch):

const userIp = req.ip; // The real user's IP
const downloadUrl = "https://appstore.nabzclan.vip/download-repo-source/1978";

const response = await fetch(downloadUrl, {
    headers: {
        "X-Forwarded-For": userIp,
    },
});

---

Option 2 (Recommended): Just tell your users to add the repo themselves
Honestly this is the easiest way and we recommend it. Instead of proxying downloads through your server, just point your users to our repo sources page and have them add it directly to their sideloading app. No code changes on your end, no IP forwarding, nothing.

Here's what to tell your users:

1. Create a free account at appstore.nabzclan.vip (takes like 30 seconds)
2. Make sure you're logged in
3. Go to appstore.nabzclan.vip/repo-sources
4. Tap the button for your sideloading app (ESign, Scarlet, AltStore, etc.)
5. That's it — the repo URL already has your personal API key attached

When they add the repo while signed in, their API key gets baked into the URL automatically. Every download goes through their own account, so there's no rate limiting, they get full download speeds up to 5GB/month, and your server is completely out of the picture.

If you want to link directly to the page from your app or site, just send users to:
https://appstore.nabzclan.vip/repo-sources
(remind them to log in first so they get their personalized repo with their API key)

Why this is better:

• Zero code changes needed on your end
• Your server never touches the downloads
• Each user gets their own bandwidth and rate limits
• Free accounts have no rate limiting on downloads
• Users get a personalized repo name with their username
• VIP users automatically get unlimited speed and bandwidth

If you're a free member, nothing really changes for you. If you're browsing as a guest, just make an account — it's free and takes 30 seconds. And if you're VIP, thanks for supporting us, your experience stays exactly the same.

A Warning About Proxies
We're going to be straight with you — if we start seeing people using proxy lists or rotating IPs to get around the rate limits, we will be forced to add a proxy/VPN detection checker to the download system. We really don't want to do that because it'll just end up hurting regular users who happen to be on a VPN for privacy reasons. But if people abuse it, we won't have a choice. So please, just respect the rules. They're not there to annoy you, they're there so we can keep the service running for everyone. If you don't want to play by the rules, then don't use Nabzclan projects. Simple as that.

As always, if something seems broken or you're having issues downloading, open a ticket https://helpdesk.nabzclan.vip and we'll look into it.

Custom Certificate Signing has been fixed - 3:00 am last min update

- Nabzclan Team