[XTR] IP Threat Monitor 1.1.1

With this release, based on extensive community feedback, search engine verification, Apple privacy integration, traffic analytics, and registered member protection have been thoroughly revamped and refined.

Key Highlights:

• Official DuckDuckBot & Fake Bot Shield: DuckDuckBot is now verified directly against DuckDuckGo's official live IP registry with automatic background updates. Spoofed bots originating from cloud hosts (such as AWS) are immediately blocked by your security policies and highlighted with a clear "Fake Bot" badge in the admin panel.
• Apple iCloud Private Relay Optimization: Identification of Apple Private Relay visitors across IPv4 and IPv6 subnets has been perfected. External VPN API lookups are now bypassed for genuine relay traffic, protecting your API quotas.
• Registered Member Safe Harbor: Logged-in members are now strictly exempt from auto-ban rules, even if they encounter rapid 404/403 error pages caused by site permissions or thread pre-approval redirections.
• Accurate Attackers & Real-Time Activity Streams: The "Top 10 Attackers" table now strictly showcases verified blocked or blacklisted threats, eliminating innocent visitors. The dashboard's "Recent Activity" stream now sorts records in true descending chronological order.

---

Change Log (1.0.42)

• Fixed: Replaced legacy/broad AWS ranges with official DuckDuckBot JSON verification and added a weekly automated cron sync.
• Fixed: Resolved IPv6 address aggregation issues preventing Apple iCloud Private Relay from bypassing external ProxyCheck API lookups.
• Fixed: Prevented logged-in registered users from being permanently blacklisted during repeated 404/error page occurrences.
• Fixed: Filtered the Top 10 Attackers list to strictly contain blocked and blacklisted IP addresses rather than active benign visitors.
• Fixed: Dashboard Recent Activity stream now correctly orders records chronologically by most recent visit.

This release brings significant improvements to threat detection accuracy, interface consistency, and the visual quality of admin pages. Here are the highlights:

Smarter Bot Detection
Previously, all visits from Google's IP ranges were labelled identically. Now, each of Google's individual services — such as the Chrome prefetch proxy, the site association service, the read-aloud agent, and the Search Console crawler — appears in the list under its own correct name. This makes it much easier to understand exactly which Google service is visiting your site.

Guest Filter Now Works Correctly
When filtering the IP list to show only "guest visitors", search engine bots were incorrectly appearing in the results. This has been fixed at the root. The guest filter now exclusively shows real human visitors, and all search engine and service bots are properly excluded from this view.

Apple iCloud Private Relay Support
Visitors coming through Apple's privacy-focused iCloud Private Relay infrastructure are now correctly recognised by the system, preventing false blocks. The IP range list is updated automatically in the background.

Live Charts Added to Setup & Test Pages
The Setup Wizard and Test Configuration pages now include the same live statistical charts found on other admin screens. Block reason breakdown and geographic distribution can now be monitored visually on these pages as well.

Test Page Redesigned
The "Overall Score" section was taking up too much vertical space on the page. It has been redesigned into a compact, modern, and readable layout. The score, progress bar, and rerun button are now neatly aligned in a single horizontal row.

Change Log

Bug Fixes

• Fixed an issue where Google and other search engine bots appeared in the IP list when the "Guests only" filter was applied.
• Google services whose User-Agent headers do not contain the standard word "bot" (e.g. Chrome prefetch proxy, site association service) are no longer incorrectly classified as guest visitors.
• Fixed all visits from Google's IP ranges being displayed under a single identical label regardless of the actual service.

New Features

• Added automatic update infrastructure for Apple iCloud Private Relay IP address ranges.
• Added accurate and granular labels for Google's specialised services: Chrome Prefetch Proxy, Association Service, Read-Aloud, Search Console, StoreBot, AdsBot, AdSense, Feedfetcher, and more.
• Added live statistics chart grid to the Setup Wizard page.
• Added live statistics chart grid to the System Diagnostics page.
• Added live statistics chart grid to the Test Configuration page.

Interface Improvements

• Replaced the oversized "Overall Score" block on the Test Configuration page with a compact, modern health status bar that takes up minimal vertical space.
• The "ON / OFF" labels on the Setup Wizard page are now translatable phrases from the language pack instead of hardcoded text.
• Template label classes updated to be fully compatible with XenForo's official style system.

Under the Hood

• The country code backfill routine was rewritten to use XenForo's own data access layer instead of raw database queries.
• New language phrases added: ON, OFF, Block Reasons Breakdown, Captcha (Soft), Captcha (Hard), Block Only.

In this update, we focused on eliminating confusion caused by spoofed bot signatures and brought total clarity and transparency to your traffic and threat monitoring logs.

1. Visual Distinction for Spoofed Crawlers (Fake Bot Detection)
Malicious crawlers and scrapers frequently disguise themselves as legitimate search engines (like Googlebot or Bingbot) to bypass rate limits. While our security engine already caught and blocked these bad actors under the hood, displaying a blue legitimate bot badge in the ban lists could create the false impression that real search engines were being blocked.
Starting with v1.0.40

• Any IP spoofing a search engine identity that fails verification is now clearly labeled with a distinctive orange warning badge.
• Hovering over the badge provides a clear tooltip explaining that the IP disguised its identity and was blocked accordingly.
• Administrators can now instantly differentiate between genuine search crawlers and disguised attackers at a single glance.

2. Cleaner Traffic & Visitor Separation
We have refined the visitor type filters to separate organic human visitors from automated bot noise even more cleanly. Reviewing genuine community engagement without crawler distortion is now easier than ever.

3. Enhanced IP Details Modal
The IP details overview now includes instant bot verification status, giving you complete peace of mind when examining suspicious network activity.

• New Feature: Introduced Fake / Spoofed Bot Detection system.
• Visual Enhancement: Added a prominent orange warning badge with a secret-agent icon for IPs spoofing crawler identities across all list views (Blacklist, Blocked, Live Monitor, Dashboard, and Analytics).
• Enhancement: Added informative tooltips explaining why an unverified or spoofed bot was flagged and blocked.
• Enhancement: Added dedicated bot identification and verification status to the IP Details modal.
• Improvement: Refined visitor type filtering to clearly separate organic human guests from automated crawler traffic.
• Bug Fix: Resolved the visual glitch where blacklisted fake bots displayed the legitimate blue search engine badge.

We are thrilled to announce the release of IP Threat Monitor version 1.0.39! This major update focuses on making security management intuitive, fully transparent, and visually engaging through multi-criteria exclusion filtering, granular visitor & bot labeling, enriched CSV exports, quota-free offline protection, and interactive analytics grids.

What's New in Version 1.0.39?

• Balanced 3x3 Analytics & Dashboard Grid: Transformed the dashboard and analytics views into an aesthetic 9-card visual grid. Enjoy interactive HTML5 canvas donut charts (Visitor Types, Block Reasons, Blacklist Sources) and country distribution cards with flags and colored progress bars for Total Traffic, Blocked Geographies, and Threat Origins with zero empty space.
• Universal Visitor & Bot Identification: Search engine crawlers (Googlebot, Bingbot, YandexBot, SEMrush, Meta, etc.) are now highlighted with blue badges across all monitor lists. Furthermore, unlabeled organic visits now carry a clean Guest badge, ensuring total clarity on who is browsing your community.
• "Is Not" Multi-Country Exclusion Filter: Easily isolate and examine traffic originating outside your primary target audience. For instance, if your forum targets the DACH region (Germany, Austria, Switzerland), you can input multiple country codes (e.g. DE, AT, CH) and switch to the "Is not" filter mode to filter for foreign or suspicious traffic.
• Enriched CSV Export with Country and ASN: Downloadable visitor exports now feature dedicated Country (ISO codes) and ASN (autonomous system numbers) columns alongside detailed ban reasons. The export button is now filter-aware, allowing you to export either your complete logs or specifically filtered segments.
• Quota-Free Local Network Protection: Block data center crawlers, VPNs, and malicious hosting providers without expending external API credits. The new built-in offline network lookup identifies and acts on unwanted server networks directly on your machine.
• Native XenForo 2.3 Time-Series Trend Charts: Gain a bird's-eye view of threat patterns. The dashboard and analytics screens feature native interactive line charts tracking active requests, temporary blocks, and blacklisted IPs over 24-hour, 7-day, and 30-day intervals.

Change Log

New Features & Improvements:

• Symmetrical 3x3 Visual Grid: Designed a 9-card responsive analytics grid covering Visitor Donut, Block Reasons, Blacklist Breakdown, Traffic Origins, Blocked Geographies, Threat Geographies, Status Breakdown, Hourly Activity, and Server Load.
• Unified Labeling Across All Data Tables: Implemented a consistent labeling hierarchy (Members with profile links, Bots with blue robot badges, and unregistered users with subtle grey Guest badges) across the IP List, Blocked IPs, Blacklist, Analytics, and Dashboard views.
• Negation Country Filtering ("Is Not" Mode): Added an "Is" vs "Is not" mode toggle to the country filter, powered by WHERE country_code NOT IN (...) queries.
• Multi-Country Queries with Autocomplete: Enabled comma-separated multi-country filtering with dynamic HTML5 datalist autocomplete based on active database records.
• Filter-Aware CSV Export with Country & ASN: Upgraded Export.php with Country and parsed ASN columns, ensuring exports respect all active filters.
• Bot Identification Badges & Search: Prominently display bot names and enable searching directly by crawler names (e.g., "Googlebot", "Bingbot", "Yandex").
• One-Click Active Filter Badges: Added filter chips allowing administrators to quickly see applied filters and remove them with a single click.
• Local Network (ASN) Engine & Diagnostics: Added server-level offline ASN identification and a new diagnostic test verifying local database integrity.
• Time-Series Threat Graphs: Integrated period-aware (24h, 7d, 30d) line charts using XenForo's built-in Chartist library.

Bug Fixes & Maintenance:

• Standardized filter form actions and pagination URL parameters to comply with XenForo routing.
• Optimized table cell vertical alignments and badge typography for high readability.

In this version, our primary focus has been maximizing system security, preserving forum speed and server resources, achieving seamless visual compatibility with XenForo 2.3, and incorporating valuable user feedback to make administration even smoother.

Key Highlights​

1. Advanced Fake Bot Protection
A strict verification mechanism has been implemented to prevent malicious actors and scrapers from bypassing rate limits by spoofing legitimate search engine User-Agents such as "Googlebot". Unverified bots can no longer bypass security thresholds.

2. High Performance & Zero Page-Load Overhead
Repetitive blacklist database queries on each page view have been transitioned to an intelligent caching layer. Even under heavy traffic, your forum runs smoothly with faster page transitions.

3. External Service Resilience & Uninterrupted Browsing
Even if external VPN detection or lookup services experience slowness or temporary outages, your forum pages won't stall. Priority is always given to local GeoIP verification to ensure a continuous browsing experience for your visitors.

4. Country Flags in Analytics & Across Admin Panels
Based on community suggestions, country flag icons have been added to the "Top 10 Attackers" list on the Analytics screen as well as to the individual IP Details view. Furthermore, missing country codes for existing blocked, blacklisted, and logged IPs are now automatically backfilled via local GeoIP.

5. Trusted IPs in All Lists & Quick Search
IPs configured in the Trusted list option are now fully synchronized with the core IP log database. You can now conveniently view, filter, and search trusted IPs under "All IPs" and "Active" list views.

6. Seamless Large Data Export (CSV)
Even with tens of thousands of log records, CSV log exports now stream data in chunks without exceeding server memory limits or timing out.

7. Native XenForo 2.3 User Experience
The IP List filtering and search interface has been upgraded to take full advantage of XenForo 2.3's native quick-search framework, offering keyboard shortcuts and instant filtering.

• New Feature: Added country flag display to the "Top 10 Attackers" table on the Analytics dashboard.
• New Feature: Added country flag and ISO country code details to the individual IP Details view.
• Improvement: Synchronized the Trusted IPs option with the main IP log table; trusted records are now searchable and visible across "All" and "Active" IP views.
• Improvement: Integrated automatic local GeoIP resolution during IP blocking and blacklisting; existing records with missing country codes are automatically backfilled during upgrade.
• Security: Tightened verification against fake search engine bot User-Agents attempting to bypass rate limits.
• Security: Added strict permission checks to the administrative test configuration tool.
• Performance: Transitioned per-request blacklist database lookups to an intelligent cache layer to reduce server load.
• Stability: Implemented smart timeouts and circuit breakers for external lookup services to prevent page stalls.
• Improvement: Converted large CSV log exports to a chunked streaming model to prevent PHP memory exhaustion.
• Improvement: Preserved session and database integrity during rate-limit blocks with clean response terminations.
• Alerts: Modernized admin threat notifications to use native XenForo alert handlers with clickable detail links.
• XenForo 2.3 Compatibility: Replaced legacy filtering scripts with XenForo 2.3's native quick-filter system.
• Interface: Refactored analytics charts to adhere strictly to XenForo 2.3 template and CSP security standards.
• General: Added structural safeguards against cache initialization race conditions on shared hosting environments.

This update focuses heavily on real-world reliability, ensuring that your community remains protected and smooth even during sudden visitor traffic spikes, while keeping your search engine presence completely safe.

What's New in Version?

• Rock-Solid Stability During Traffic Surges:
  We refined our background monitoring engine to eliminate any friction or conflicts when hundreds of visitors hit your forum at the exact same moment. The protection runs quietly in the background without causing unexpected system warnings or interruptions.
• Smarter Memory & Storage Transition:
  Temporary threat records are now smoothly organized without repeating redundant checks. Older records seamlessly transition into the new storage layout, ensuring your server remains fast and responsive without unnecessary overhead.
• Dedicated Data Protection & Isolation:
  The maintenance and reset tools in your Admin Panel have been fine-tuned to operate solely on IP Threat Monitor's own storage. You can safely clear temporary security caches knowing that the rest of your forum and other add-ons remain completely untouched.
• Flawless Search Engine Crawler Recognition:
  We improved how search engine crawlers (such as Google, Bing, etc.) are verified. Legitimate bots indexing your content will never be accidentally blocked, keeping your SEO rankings fully protected at all times.

---

• Resolved a file-creation conflict that could generate unexpected server warnings during sudden, high-volume visitor traffic spikes.
• Temporary cache entries from previous versions now automatically and seamlessly migrate into the new balanced structure without dropping records.
• Admin Panel cleanup tools are now strictly isolated to IP Threat Monitor data, ensuring core forum registries are never affected.
• Upgraded search engine bot detection so legitimate crawlers (Google, Bing, etc.) are accurately identified and never mistakenly rate-limited.
• Corrected missing diagnostic notification phrases in the Admin Tools to ensure clear and descriptive test results.

We strongly recommend all users upgrade to this version for the best and most stable experience. Thank you for your continued support!

We are delighted to announce the release of IP Threat Monitor 1.0.36! This update focuses heavily on real-world stability, server storage efficiency, and deep alignment with the XenForo 2.3 ecosystem based on direct feedback from our customers.

• Smart Storage & Disk Optimization:
  We completely revamped the file-based caching mechanism to eliminate disk clutter and folder slowdowns. Cache files are now neatly organized into balanced subdirectories, and expired temporary data is automatically pruned throughout the day without placing any burden on your server.
• Instant One-Click Cache Purge:
  Administrators can now safely purge on-disk threat cache files directly from the Admin Panel with a single click, taking mere milliseconds without freezing the server.
• Native, Self-Hosted Country Flags:
  All flag displays across logs and user messages have been migrated to XenForo's built-in local sprite library, completely removing dependencies on third-party CDNs. This guarantees lightning-fast loading, strict privacy compliance, and zero external failure points.
• Staff Immunity & Smooth Navigation:
  Staff detection has been refined to ensure that administrators and moderators performing daily tasks never accidentally trigger rate limits or security verification screens.
• Setup Wizard & Configuration Harmony:
  Our preset configuration profiles (Starter, Standard, Aggressive) now work in 100% synergy with the Test Configuration suite, ensuring zero false warnings and smooth verification out of the box.

Upgrade Notice: Upgrading is completely seamless. The update routine automatically detects legacy cache files and migrates them in the background without requiring manual server commands.

Click to expand...

We recommend all customers update to version 1.0.36 to enjoy the smoothest and most secure protection for their forums.

• Sharded Directory Structure: File-based cache storage now distributes files across balanced subfolders, permanently preventing directory bloat and file count limits on Linux servers.
• Real-Time Background Garbage Collection: Expired temporary counters are now continuously and silently cleaned up during write operations without waiting for nightly cron runs.
• Admin CP Cache Purge Tool: Added a dedicated "Clear Threat File Cache" option under the Prune / Clear Logs dashboard to clear storage safely in milliseconds.
• Integrated Prune Routine: Running "Clear Everything" or "Smart Prune" now automatically cleans up expired cache files from disk alongside database rows.
• Native Flag Library: Completely eliminated external CDN dependencies; all country flags now render locally using XenForo's built-in sprite sheets.
• Refined Staff Exemption: Strengthened core permission checks for super admins, administrators, and moderators to ensure zero false positives during active management tasks.
• Preset & Test Harmony: Calibrated Setup Wizard profiles (Starter, Standard, Aggressive) to achieve a 100% clean pass in Test Configuration with zero false warnings.
• CLI Prune Command: Added a dedicated command-line utility php cmd.php xentr:ipt:prune-cache for server administrators.
• Automated Upgrade Healing: Upgrading automatically rotates and clears legacy cluttered directories in the background without causing upgrade timeouts.
• Fixed: Resolved excessive file generation and disk fill-up on servers operating without Redis or APCu memory drivers.
• Fixed: Fixed memory exhaustion during the nightly cleanup cron when dealing with large cache folders.
• Fixed: Resolved database schema check exceptions on the Admin CP Test Configuration page.
• Fixed: Corrected controller dispatch and rerouting behavior on configuration test actions.

This update focuses on internal security hardening, administrative permission consistency, and navigation permission alignment in accordance with XenForo 2.3.x core standards. All improvements have been implemented without altering the high-performance cache-first architecture or core rate-limiting workflows.

---

• Security Hardening:
  • Hardened the client validation check in the Rate Limit Captcha controller (RateLimitCaptcha.php). Replaced user-controllable SERVER_NAME header inspection with XenForo's trusted IP resolution ($request->getIp(true)) restricted strictly to loopback addresses (127.0.0.1, ::1).
• Admin Permission Enforcement:
  • Enforced granual admin permission checks (assertAdminPermission('xentrIPThreat')) on the extended ToolsController actions (actionXentrIptDiagnostics and actionXentrIptRunServerTest) to prevent unauthorized administrator access.
• Bug Fixes:
  • Fixed an invalid permission identifier (xentrIPThreatPermissions) in admin_navigation.xml by aligning it with the registered admin permission (xentrIPThreat). This resolves an issue where the Diagnostics menu item was hidden from non-super admins who had been granted addon permissions.

With this update, we are thrilled to bring one of the most requested features to life, along with an important data mapping improvement!

New Feature: Country Whitelist (Allowlist) Mode
You no longer need to manually add dozens or hundreds of countries to a block list!
With the newly introduced "Country Filter Mode", you can now switch the country filter to Whitelist Mode. In this mode, only visitors originating from your selected countries (e.g., US, Canada, UK) will be allowed to access your forum; all other traffic from the rest of the world is automatically and instantly blocked.

Improvement: "Users with this IP" Linking
We have improved the user lookup inside the IP Details monitor. When reviewing any IP address in the admin control panel, all registered forum members who have accessed the forum from that IP will now be accurately and instantly displayed.

We recommend all customers update to version 1.0.34 to enjoy these new capabilities!

• New Feature: Added Whitelist (Allowlist) Mode for country blocking. Allow traffic only from specific countries while automatically blocking all others.
• New Option: Added Country Filter Mode (Blacklist vs Whitelist) in Admin CP Options.
• Improvement: Fixed and optimized the "Users with this IP" section in the IP Details monitor to accurately pull all registered users associated with the IP.
• Improvement: Updated the Diagnostics and Configuration Test tools to recognize and display the active country filter mode (Whitelist / Blacklist).

How to Use Country Whitelist (Allowlist) Mode
With this feature, instead of manually blocking dozens or hundreds of foreign countries one by one, you can simply define the specific countries you wish to allow and block traffic from all other regions worldwide with a single setting.

---

Step-by-Step Configuration:

1. Navigate to Options:
   In your XenForo Admin Control Panel, go to Options > [XTR] IP Threat Monitor.
2. VPN & ASN Protection Tab:
   Click on the "VPN & Geo Blocking" tab from the top tab navigation.
3. Select Whitelist Mode:
   Under "Country Filter Mode", select Whitelist (Allow ONLY listed countries, block all others).
4. Add Allowed Countries:
   In the "Blocked Countries" list, enter the 2-letter ISO country codes of the countries you want to allow.
   Example for US & Canada only:
   • US (United States)
   • CA (Canada)
   • GB (United Kingdom)
5. Ensure Blocking is Enabled:
   Make sure "Enable Country Blocking" is checked (enabled).
6. Block on First Visit (Recommended):
   To ensure visitors from non-whitelisted countries are blocked immediately on their very first request, set "VPN Check Mode" to First Visit or enable "Force API Check for Block Lists".
7. Save Changes: Click the "Save" button at the bottom of the page.

---

Important Tips & Best Practices:

• Will Search Engine Bots be Blocked? As long as Protect Search Engine Bots is enabled, legitimate bots (Googlebot, Bingbot, Applebot, etc.) are automatically exempt and will crawl your site normally.
• Can Administrators be Locked Out? No, administrators and moderators are protected by built-in safety exemptions and are never blocked.
• Switching Back to Blacklist Mode: You can switch back to standard Blacklist Mode at any time by simply selecting "Blacklist" under Country Filter Mode.

This maintenance and quality-of-life update enhances the "IP Activity by Time" monitor on the admin dashboard.

In previous versions, activity distribution was aggregated based on the database server's default timezone (typically UTC). With version 1.0.33, the dashboard automatically adapts to the viewing administrator's local timezone configured in their XenForo account. Threat activities occurring throughout the day (Night, Morning, Day, Evening) are now accurately mapped to your actual local hours.

• Improvement: The "IP Activity by Time" dashboard chart now dynamically aligns with the viewing administrator's local timezone.
• Fix: Resolved a timezone discrepancy where activities appeared shifted due to database server UTC time differences.
• Optimization: Minor performance enhancements to the dashboard statistics aggregation queries.