[XTR] IP Threat Monitor 1.1.1

This update introduces enhanced protection against modern automated scraping threats while delivering critical stability improvements designed to prevent legitimate community members from experiencing accidental access restrictions.

To counter aggressive automated tools and AI crawlers that rapidly open dozens of discussion threads within seconds, a dedicated "Thread View Burst Rate Limiter" has been implemented. This feature monitors rapid consecutive thread views within a short time window and automatically challenges or temporarily restricts suspicious visitors or compromised accounts before server resources are exhausted. Administrators can freely configure the sensitivity threshold, time window, and choose between presenting a verification challenge or applying a temporary rate-limit cooldown.

Additionally, IP handling for dynamic residential and mobile internet connections has been thoroughly refined. The system no longer permanently restricts IP addresses when a verification challenge is abandoned or left unsolved. This ensures that genuine members who are assigned dynamic IP addresses by their service providers will never face lockouts due to earlier guest activity.

Single-attempt challenge errors no longer result in access restrictions, allowing visitors to retry verification smoothly. Furthermore, if a registered member visits from an IP that had a pending verification from background or unauthenticated requests, the system automatically resolves the status to active upon member authentication.

Configuration diagnostic checks in the administration control panel have been updated to strictly follow XenForo core standards, and text contrast across detail views has been optimized for improved clarity.

Change Log

• Thread View Burst Rate Limiter Added: Implemented a dedicated burst rate limiter to intercept automated bots and AI scrapers rapidly viewing multiple threads within seconds. Configurable threshold and time window with options to trigger a Turnstile / Captcha challenge or temporary rate-limit block.
• Member Account Burst Monitoring: Added an option to monitor regular registered member accounts used by automated scrapers under the thread burst limiter (Administrators and moderators remain fully exempt).
• Dynamic IP Safeguard: Removed permanent restrictions on abandoned or unsolved verification challenges, eliminating false positives for members on dynamic residential and mobile internet connections.
• Challenge Retry Tolerance: Unsuccessful verification attempts no longer result in access restrictions, allowing visitors to retry verification cleanly.
• Automated Member Status Healing: IPs with pending verification states caused by background or unauthenticated requests are automatically healed to active status when a registered member authenticates.
• Configuration Diagnostic Test Refinement: Upgraded interoperability detection to utilize XenForo core active add-on standards, eliminating false positive notices on sites where the companion add-on is not installed.
• Username Badge Legibility: Refined username presentation within detail views to fully inherit XenForo core label color standards, ensuring clear contrast across all displays.

In version 1.1.0, we focused on refining the inspection order, enhancing verification lifecycles, and bringing our diagnostic tools fully up to date.

What is new in this update?

First, we prioritized location and network blocking. Previously, guest dynamic route protection on pages like search and what's new ran before the blocked countries check, which meant visitors from completely restricted countries could receive a verification challenge instead of being stopped dead at the door. With 1.1.0, visitors from blocked countries or networks are immediately stopped with an access denied response without ever reaching a verification screen. Challenges are now reserved exclusively for visitors from allowed regions.

Second, we introduced automated handling for abandoned challenges. Headless scrapers or visitors who abandon the verification screen and attempt further browsing without completing the challenge will now automatically transition to blacklisted status with a clear failure reason. In addition, temporary residential proxy timers are fully safeguarded from being overwritten, and country flags now resolve immediately upon challenge creation.

Lastly, the display warning on the Analytics page has been resolved, and both the Setup Wizard and Test Configuration tools have been updated to reflect all our newest security controls, including automated BotGuard interoperability checks.

Change Log

• Security Execution Order: Blocked Countries, Blocked ASNs, and VPN checks now evaluate before dynamic route protection, ensuring visitors from restricted regions are immediately stopped at the door with a 403 Forbidden response instead of receiving a captcha challenge.
• Analytics Page Resolution: Fixed the undefined array key warning on the admin analytics page and integrated challenged visitors into all traffic breakdown charts and legends.
• Automated Challenge Expiration: Visitors who abandon the verification screen or attempt further requests without solving the challenge within the timeout window are automatically converted to blacklisted status (Challenge Failed / Abandoned).
• Blocked Status Preservation: Pre-existing temporary block statuses and expiration counters (such as residential proxy cooldowns) are now protected from being overwritten by challenge events.
• Country Flag Resolution: Country codes are now resolved and assigned immediately when a challenge is issued, ensuring geographical flags render accurately without generic placeholders.
• Setup Wizard Modernization: Updated Starter, Standard, and Aggressive profiles to include dynamic route protection and immediate block list checks, along with updated summary tables.
• Test Configuration Expansion: Added automated tests for Dynamic Route Challenges, Immediate Block List Enforcement, and BotGuard Interoperability to detect and prevent mutual redirect loops.
• Codebase Health: All file hashes and master data have been re-verified to ensure 100% integrity across XenForo file check standards.

Our main goal with this release is to provide crystal-clear reporting for site owners, eliminate confusing visitor numbers, and ensure harmonious coexistence with other forum security tools.

Seamless Compatibility with Other Security Add-ons
When running alongside other security add-ons on the same forum, visitors encountering a challenge screen could occasionally get caught in browser redirect deadlocks. In version 1.0.50, we have added strict background safeguards on our verification pages. Our challenge process now operates cleanly without triggering unexpected interference from other add-ons, allowing multiple security layers to coexist smoothly.

Accurate Challenge and Visitor Tracking
Previously, visitors who were prompted with a verification check were immediately counted alongside normal active visitors, regardless of whether they solved the challenge or abandoned the page. This occasionally gave forum owners the false impression that suspicious scrapers were browsing the site freely. With this update, challenged visitors are clearly differentiated. When a challenge is issued, it is tracked as such, and only visitors who actually complete the verification are counted as active members of your traffic. This keeps your visitor statistics honest and accurate.

Smart Protection for Resource-Heavy Dynamic Pages
Search queries and recent content streams are typically the most resource-intensive pages on any XenForo forum. To prevent aggressive scraper bots from hammering these dynamic endpoints, we have introduced an optional protection feature. You can now prompt unauthenticated guests with a quick, frictionless verification before they access heavy pages like search or what's new. Once verified, genuine visitors can browse freely without being prompted again for 30 minutes. Registered members and verified search engine crawlers remain completely unaffected.

Upcoming Versioning Scheme
With this release, the 1.0.x series has reached its planned maturity and stability. Starting with our next release, all future updates will follow a streamlined versioning format: 1.1.0, 1.1.1, 1.1.2, and so forth.

Change Log

• Added defensive response headers and cache controls to verification routes to prevent browser redirect loops.
• Implemented automatic interoperability for sites running alongside other security add-ons such as XF Bot Guard.
• Introduced a dedicated challenged visitor status to distinguish between visitors currently verifying and those who completed the check.
• Updated visitor tracking so only visitors who successfully pass verification transition to active status, keeping analytics accurate.
• Added a dedicated challenged filter tab and status metrics in the Admin CP IP List View for quick auditing.
• Added clear status labels across IP detail views to indicate visitors with pending challenge requests.
• Added an optional setting to challenge unauthenticated guests before accessing resource-heavy pages like search and what's new.
• Added an admin option to customize the list of dynamic route prefixes that require guest verification.
• Allowed guests who complete verification to browse protected dynamic routes for 30 minutes without repeated prompts.
• Prepared the versioning roadmap for upcoming releases, which will follow the 1.1.0, 1.1.1, 1.1.2 format.

With the 1.0.49 release, we are introducing a major security and user-experience upgrade designed specifically to solve one of the most frustrating dilemmas forum administrators face: dealing with scraper traffic without locking out genuine international visitors.

You Don't Have to Completely Ban an Entire Country Anymore!
Previously, blocking a country meant shutting the door on everyone from that region with a hard 403 error. In the real world, this is rarely ideal. Countries like France, Spain, or the United States are home to high volumes of automated scrapers and residential proxies, but they are also home to legitimate, valued forum members.

Starting with 1.0.49, you have granular, flexible control:

• Hard Blocked Countries (403 Forbidden): Instantly block traffic from regions you never want on your site (e.g. China, Singapore).
• Challenged Countries (Turnstile / Captcha): Instead of outright banning countries with mixed traffic, visitors are simply presented with a quick verification challenge. Real humans verify in one click and browse freely, while headless scrapers and bots are stopped cold.
• Granular Control for ASNs as Well: Apply the exact same logic to hosting providers and networks (Hard 403 vs. Captcha Challenge).

Smart Priority Hierarchy (Datacenter Scrapers Can't Sneak In)
If you set the United States to "Challenged," what happens when a scraper hits your forum from an AWS or DigitalOcean datacenter located in the US? Our verification engine ensures datacenter rules take strict precedence: because that datacenter ASN is on your blocklist, it receives an immediate 403 Forbidden. Country-level challenges will never downgrade a blocked datacenter bot!

Dynamic Return Redirect & 30-Minute Grace Window
When genuine visitors solve the challenge, they aren't kicked back to your home page—they are seamlessly redirected straight to the thread or page they originally clicked on. Once verified, they enjoy a 30-minute browsing grace period so they never get interrupted on every page click.
[XTR] IP Threat Monitor 1.0.49 Changelog

New Features & Improvements:

• New: Added dedicated Challenged Countries (Turnstile / Captcha) list. Visitors from these countries receive a verification prompt instead of an outright 403 ban.
• New: Added dedicated Challenged ASN List (Turnstile / Captcha) to verify traffic from specific networks with challenges rather than hard blocks.
• Improvement: Smart Priority Hierarchy: Blocked Datacenter ASNs and ProxyCheck detections are evaluated before country challenges, ensuring malicious datacenter scrapers can never bypass a block via country settings.
• Improvement: Dynamic Return Redirect: Visitors who pass the challenge are automatically redirected back to their originally requested thread or page.
• Improvement: 30-Minute Grace Window: Verified human visitors enjoy uninterrupted browsing across the forum for 30 minutes without repeated challenges.
• Improvement: Integrated dynamic return redirects into error-page rate-limiting challenge responses as well.
• Improvement: Verified search engine bots (Googlebot, Bingbot, etc.) and Apple iCloud Private Relay users remain fully protected and exempted from all challenge hurdles.

In this update, we have made significant improvements, particularly regarding Apple privacy service verification, Autonomous System Number (ASN) lookups, and graphical visibility.

Hardened Apple iCloud Private Relay Verification
Following feedback from our community, we identified that an overly broad legacy fallback IP definition was inadvertently allowing certain cloud hosting servers (such as Linode/Akamai VPSs) to be misclassified as Apple Private Relay connections. In v1.0.48, this definition has been completely removed and synchronized exclusively with Apple's official egress IP ranges and verified partner relays. Genuine Apple devices continue to pass smoothly, while automated cloud crawlers and hosting servers are now correctly caught and filtered.

Dedicated Network (ASN) Search & Automatic Data Backfill
The log search engine has been significantly upgraded. Administrators can now search and filter visitors directly by their detected Autonomous System Number (ASN). When upgrading to v1.0.48, the system automatically scans your existing log history and populates network information using the local lookup database. In addition, each log entry now displays its detected network code directly beneath the IP address for quick inspection.

Clarity for Expired Temporary Blocks
To eliminate confusion between currently enforced blocks and past security events: When a temporary block window lapses, the log list now clearly distinguishes it with a muted "Blocked (Expired)" badge with an informative tooltip. Active restrictions remain boldly flagged, giving you instant clarity regarding your forum's live security status.

Trend Chart Mouse-Over Enhancements
Resolved an SVG layer overlap issue on the dashboard trend chart where overlapping blacklisted lines could obstruct mouse hover events over the active visitor line. Administrators can now easily inspect hover statistics across all series without visual interference.

Changelog

Fixes & Improvements

• iCloud Private Relay Hardening: Removed an overly broad fallback CIDR that allowed third-party hosting IPs (e.g. Linode) to be falsely recognized as Apple Relay; aligned strictly with official egress standards.
• Dedicated ASN Column & Accurate Search: Added a dedicated, indexed network column to the threat log database. Administrators can now search and filter logs directly by detected ASN values.
• Automatic Historical ASN Backfill: Upgrading automatically enriches your existing log records with their corresponding network identifiers using the local lookup database.
• Visual ASN Badges: Added clean network identifier badges beneath IP entries in the log view for immediate visibility.
• Expired Block Labeling: Added an informative "Blocked (Expired)" status badge so administrators can easily distinguish between ongoing active blocks and past historical events.
• Trend Chart Hover Resolution: Fixed SVG pointer event obstruction where overlapping blacklisted lines prevented tooltips from triggering on the active traffic line.

This update focuses on delivering smarter protection for residential visitors and refining log filtering within the Admin Control Panel.

Smarter Handling for Home and Mobile Internet Users
Dynamic IP addresses used by home broadband and mobile network providers rotate frequently. Occasionally, an ordinary household connection may temporarily host an unauthorized proxy and get flagged by security lookup services. However, these services also clear such dynamic addresses very rapidly once the issue resolves.

Previously, dynamic home connections were permanently added to the blacklist upon detection, which could unintentionally lock out innocent forum members for extended periods.

With v1.0.47:
Suspicious connections originating from residential or mobile networks are no longer permanently blacklisted. Instead, the system applies a temporary block aligned with modern threat listing lifecycles. As soon as the lookup service clears the address, your visitors automatically regain access without requiring any manual intervention by administrators. Dedicated server attacks, web hosting proxies, and malicious networks remain strictly blocked as always.

Enhanced Active Log Filtering in Admin CP
Based on community feedback, we have enhanced the log filters in the Admin Control Panel. When viewing the "Active" filter, the list now displays both regular active visitors and your trusted IP addresses currently browsing the forum. This gives administrators a complete, unified overview of all permitted ongoing traffic in one single view.

We sincerely thank our community members for their invaluable feedback and continued support!

Changelog

New Features & Improvements

• Smart Residential & Mobile Protection: Transient proxy detections on consumer broadband and mobile networks are no longer permanently added to the blacklist. A temporary block is applied instead, preventing legitimate community members from experiencing accidental long-term lockouts.
• ProxyCheck Caching Guidance Compliance: Cache duration for dynamic residential detections has been aligned with current security lookup guidelines, while clean lookups continue to be cached efficiently to protect your API usage quota.
• Active Log Filter Enhancement: When selecting the "Active" filter in Admin CP Threat Logs, permitted Trusted IPs currently browsing the forum are now included alongside standard active visitors.
• Informative Temporary Ban Reasons: Added dedicated log reason phrases explaining when a connection is temporarily held as a dynamic residential proxy.
• General Stability & Refinements: Optimized finder queries and hardened validation across all log filtering processes.

This maintenance and optimization update focuses on full search engine crawler verification (specifically Qwantbot), eliminating false-positive "Fake Bot" labels, auto-healing verified bots on the fly, and dramatically accelerating the background bot remediation job.

Key Highlights

• Built strictly against official Qwant crawler documentation and daily IP prefixes. Genuine Qwant crawlers are now verified via official subnets and Forward-Confirmed Reverse DNS (FCrDNS), permanently resolving the issue where genuine bots were incorrectly flagged as "Fake Bot".
• If a legitimate, verified search crawler (Google, Bing, Qwant, etc.) carried a historical block or rate-limit violation in the database, the security engine now automatically restores its status to active on its next crawl, clearing old blacklist records and cache transparently.
• The bot remediation tool (xf-rebuild:xentr-ipt-remediate-bots) has been re-engineered with high-performance in-memory CIDR matching and smart User-Agent pre-filtering. A process that previously took hours across tens of thousands of records now finishes in just a few seconds.
• All analytical chart and distribution queries have been upgraded to strict PDO prepared statement parameter bindings, ensuring 100% adherence to XenForo 2.3 coding standards and best practices.

Version 1.0.46 Changelog

• Fix: Resolved a false-positive condition where legitimate Qwant crawlers were incorrectly tagged as [Fake Qwant (Qwantify)] in the ACP Threat Log.
• Improvement: Integrated official Qwantbot IP ranges and dual-stack Forward-Confirmed Reverse DNS (FCrDNS) verification matching official crawler specifications.
• New Feature: Implemented on-the-fly auto-healing for verified search engine bots, restoring historical blacklist and rate-limit violations back to active status automatically upon live visits.
• Performance: Drastically optimized the RemediateBots background rebuilder with in-memory CIDR evaluation and smart User-Agent pre-filtering, reducing processing time on large databases from hours to seconds.
• Security & Standards: Refactored all aggregation and chart queries in the repository to strict PDO prepared statement parameter bindings.

This maintenance and stability update is specifically designed to eliminate upgrade freezes on high-traffic boards with large IP log databases and to ensure seamless crawling for verified search engines.

Key Highlights:

• Instant & Seamless Upgrades: Resolved an issue where forums with extensive threat logs experienced timeouts or "Action pending" screens during upgrades. Add-on updates now complete smoothly within seconds.
• Non-Blocking Background Remediation: Verified search engine crawlers (Googlebot, Bingbot, etc.) and Apple iCloud Private Relay users that may have been caught by ASN rules are now safely restored in the background without impacting forum performance or page speed.
• Rebuild Caches Tool Integration: Administrators can now run this scan at any time directly from the Admin Control Panel under Tools -> Rebuild caches, complete with a real-time progress bar.
• Automated Daily Maintenance: Integrated into the daily maintenance schedule to continuously ensure legitimate web crawlers and privacy relay users never stay blocked.

Change Log

• Fix: Eliminated installer timeouts and upgrade stalls on high-volume boards with large log tables; add-on upgrade now finishes instantaneously.
• New Feature: Introduced a background deferred remediation process to safely restore falsely restricted search engine bots and Apple Private Relay IPs in optimal slices.
• New Feature: Added a dedicated rebuild tool under Admin CP -> Tools -> Rebuild caches with live progress bar support.
• Enhancement: Automated daily cleanup schedule now continuously inspects and unblocks legitimate bots in the background.
• CLI Support: Added direct command-line support (php cmd.php xf-rebuild:xentr-ipt-remediate-bots) for server administrators managing large forums.

We are pleased to announce the release of v1.0.44 for IP Threat Monitor! This update brings crucial improvements designed to safeguard your search engine indexing (SEO), eliminate cloud network dilemmas, and provide granular control over search engine bots.

Key Highlights:

• Search Engines vs. Cloud Scrapers Dilemma Solved:
  Blocking large cloud infrastructure (such as Microsoft Azure to stop aggressive AI scrapers) previously risked affecting legitimate crawlers like Bingbot sharing the same network. With 1.0.44, officially verified search engine bots automatically bypass network (ASN) and country block rules. You can now keep cloud scraper networks blocked with complete peace of mind without hurting your SEO rankings.
• Granular Google Bots & Future-Proof Fallback:
  Instead of a single blanket setting for Google, bot options are now diversified by purpose. You can easily keep standard Google Search indexing active while selectively blocking AI training crawlers (Google-Extended) or R&D scrapers. In addition, a new "Other Bots from Google" fallback option ensures that whenever Google introduces a new crawler in the future, it will pass through safely without waiting for an add-on update.
• Seamless iCloud Private Relay Access:
  Evaluation priority has been optimized so that legitimate Apple iCloud Private Relay visitors are recognized before network filters, ensuring Apple users browse your community without false blocks.
• Automated Historic Remediation:
  Upon upgrading to 1.0.44, the updater automatically inspects historic logs and safely unblocks any verified search crawler IPs that were caught by previous network-level rules, restoring clean indexing instantly.

Changelog

• New: Diversified Google bot settings with granular controls (Google Search indexer, Search Console Inspection, GoogleOther AI, Google-Extended AI training, Ads, and Shopping crawlers).
• New: Added "Other Bots from Google (Fallback / Unlisted)" option to future-proof against new or unlisted Google services without requiring add-on updates.
• Improvement: Verified search engine crawlers (Googlebot, Bingbot, etc.) now bypass ASN and Country filters, preventing false positives when cloud provider ASNs (e.g. Azure AS8075) are blocked.
• Improvement: Prioritized Apple iCloud Private Relay checks before ASN filters to ensure seamless connectivity for legitimate Apple users.
• Improvement: Added automated upgrade remediation to safely unblock verified crawler IPs that were historically caught by network block rules.
• Improvement: Updated and expanded official Google search engine IP network ranges.
• Improvement: Seamless option migration during upgrade to maintain complete protection without configuration reset.

This update focuses on enhancing your administrative experience, providing cleaner reporting, and broadening support for modern web crawlers based directly on user feedback.

Key Highlights:

• Visual Badges for Apple Private Relay: Legitimate visitors browsing via Apple iCloud Private Relay are now highlighted with a distinctive sky-blue badge across admin log views, allowing you to instantly distinguish them from standard VPN or suspicious proxy traffic.
• Cleaner & More Detailed CSV Exports: Exported log files now provide better organization details, network providers, and clearer membership information for comprehensive reporting.
• Fediverse & Decentralized Web Crawler Support: Friendly bots and link previewers from decentralized platforms such as Mastodon, Lemmy, Akkoma, and Misskey are now recognized seamlessly, preventing false-positive blocking.
• Polished Setup Wizard & Interface Translations: Preset configuration cards in the Setup Wizard have been polished to properly display all localized settings and status toggles without raw keys.

Thank you for your continuous feedback and support.

Change Log

• New: Added dedicated sky-blue badges in admin logs for visitors using Apple iCloud Private Relay.
• Improvement: Enhanced CSV export data structure with clear network provider names, organization details, and member info.
• Improvement: Added recognition and protection for Fediverse crawlers (Mastodon, Lemmy, Akkoma, Misskey) to prevent false-positive flags.
• Improvement: Improved reason descriptions for VPN and Proxy detections in security logs.
• Fix: Resolved raw phrase and option key outputs on preset cards in the Setup Wizard.
• Fix: Corrected missing localized phrases and refreshed template compilation across the administration interface.