[XTR] IP Threat Monitor 1.1.2

This release completely rethinks how the add-on distinguishes genuine threats from innocent visitors, while bringing the responsiveness, stability, profile management, and localization of the admin control panel to the highest level. Our goal is not simply to create harsher barriers, but to make fewer wrong decisions—protecting your community while keeping panel management effortless and reliable.

Verification applies only to the individual: Passing a robot challenge now grants access exclusively to the specific visitor who completed it; other users sharing the same network do not inherit this clearance. The clearance is bound strictly to that person's session and expires naturally. Bypassing the check by navigating directly to the challenge URL has also been resolved.

Hard restrictions cannot be bypassed: Visitors originating from countries or networks you have chosen to block can no longer bypass restrictions via a verification challenge; your strict blocking rules are enforced immediately and decisively.

Independent VPN, proxy, and hosting detection: These three categories are now evaluated independently and can be toggled on or off individually. This allows flexible configurations, such as challenging VPN connections while allowing datacenter traffic.

Addresses are no longer burned: Network-level suspicions result in brief, temporary pauses that clear themselves automatically once the duration expires. Permanent blacklisting is now reserved strictly for explicit administrator actions.

Bots verified through official sources: Search engine and AI crawler address pools are pulled directly from their publishers' official sources and verified in both directions. Privileges are never granted simply based on claimed browser signatures.

Complete Apple Private Relay integration: All published Apple Private Relay address ranges are continuously tracked, ensuring legitimate iPhone and Mac traffic is never falsely categorized as a threat.

Active crawler display and widget integration: Legitimate search engine and crawler bots (Googlebot, Bingbot, Applebot, etc.) can now be displayed directly in the "Members online" widget alongside their official brand icons. Powered by an ultra-fast caching layer, this feature places zero additional load on your database. Clicking on any bot in the widget automatically navigates to the dedicated "Robots" tab and filters active sessions exclusively for that specific crawler with a one-click dismissible filter bar. In addition, the Current Visitors page now displays the exact target URLs and verification redirects bots are browsing instead of generic "Unknown page" placeholders.

Persistent security profiles and smart wizard: Preset configuration profiles (Starter, Standard, Aggressive) selected in the Setup Wizard are now stored permanently. Adjusting individual settings or updating the add-on no longer resets your profile to a generic "Custom" state; the system preserves your base profile and tracks your changes as "Customized". The active profile card displays your live forum settings and highlights modified entries with a clear "Customized" badge, with a one-click option to revert to baseline defaults at any time.

Profile-aware testing and accurate health reporting: The Test Configuration tool is now fully synchronized with your active security profile. If you choose the lightweight "Starter" profile, intentionally disabled features such as rDNS or VPN lookups are evaluated against Starter targets rather than triggering false warnings. In addition, an inconsistency where optional settings caused the top health bar to display false warnings has been resolved, ensuring 1:1 harmony between the summary score and detailed table rows.

Instant admin control panel: Substantial loading delays and freezes previously experienced on the dashboard, analytics, IP list, and blocked lists have been completely resolved. Heavy background evaluation loops covering hundreds of thousands of subnets have been replaced with smart, instant guards. External network lookups during page rendering have been eliminated, and database workload has been streamlined for immediate page loads.

Reasons and alerts in your own language: Action reasons and challenge statuses now seamlessly respect your active control panel language. Previously, reasons baked into the database in the visitor's language remained untranslated; they are now dynamically localized to match whatever language you are using in the control panel. All remaining hardcoded strings have been connected to the phrase system.

Flexible daily maintenance: You can now schedule the exact hour and time zone for daily cleanup. Schedule drift during daylight saving time transitions has been resolved, and abandoned challenges are pruned automatically so innocent visitors never stay locked out. The add-on strictly touches only its own settings during installation.

Known limitations: If the external threat detection provider is temporarily unreachable, addresses are not marked clean and forgotten; they are queried again shortly. New options ship with safe defaults; we recommend reviewing your settings once after updating.

Change Log

Admin control panel & performance

• Severe loading delays and freezes on dashboard, analytics, IP list, and blocked list pages have been resolved; pages now load instantly.
• Scanning hundreds of thousands of network ranges has been replaced with a high-speed smart filter, eliminating CPU spikes.
• Prevented admin page freezes caused by background external network requests executing during view rendering.
• Consolidated multiple redundant counting queries into a single database operation; user records are now loaded efficiently in one pass.
• Resolved an open directory restriction warning encountered when accessing cache files on certain server environments.

Setup wizard & profile management

• Resolved an issue where preset profiles in the Setup Wizard were lost after modifying options or updating the add-on; active profiles are now stored persistently.
• Introduced base profile customization tracking: deviations from preset defaults are clearly noted while keeping the base profile intact, complete with a one-click reset to preset defaults.
• Implemented Smart Active Cards: the active profile card reflects live forum configuration while highlighting customized values against preset baselines.

Configuration testing & system health

• Synchronized the Test Configuration tool with the active security profile; expectations and threshold checks dynamically adapt to the active profile (Starter, Standard, Aggressive).
• Fixed a calculation discrepancy where optional display settings (such as country flags) caused the health summary to show a false warning despite all table rows passing.
• Added an interactive active profile badge to the Test Configuration health bar with direct navigation back to the Setup Wizard.

Language & phrase system compatibility

• Action, challenge, and blocking reasons now dynamically match your active control panel language; legacy English database entries now display in your chosen language.
• Hardcoded strings in the thread view burst rate limiter have been converted to official phrases and included in the language file.
• All status and reason descriptions across the panel now describe visitor events more clearly and informatively.
• Added the missing verification phrase (verifying_captcha) to eliminate localization discrepancies.

Robot challenge & visitor clearances

• Challenge passes previously leaked across visitors sharing the same IP; clearance is now bound strictly to the individual visitor's session.
• Prevented challenge bypass caused by navigating directly to the verification URL.
• Visitors no longer enter infinite redirect loops when challenges are disabled or unavailable; temporary pauses with clear explanations are shown instead.
• Resolved an issue where spoofing the referer header could allow skipping verification.
• Challenge clearances now carry an explicit lifetime and expire automatically.
• Payment callback scripts (payment_callback.php) and critical endpoints have been fully exempted from verification challenges and rate limits.

Blocking decisions

• Visitors from blocked countries or networks can no longer bypass strict protection by completing a challenge; hard restrictions now take precedence unconditionally.
• Suspicious network ranges are no longer permanently blacklisted; they receive self-expiring temporary blocks instead.
• Administrator manual blacklist entries can no longer be superseded by challenge clearances or background tasks.
• Verification screens are no longer unnecessarily presented to addresses already subject to definitive bans.
• VPN, proxy, and hosting detection can now be enabled or disabled independently.
• Datacenter and proxy intercepts are now displayed with their own clear, dedicated reason labels.
• Shared residential connections now receive longer but strictly temporary pauses rather than permanent blacklisting.
• The known VPN provider separation setting now functions as intended and descriptions have been updated to reflect actual behavior.

External threat intelligence

• Modernized threat intelligence querying to retrieve country, network, connection type, and risk score in a single request.
• When external services are unreachable or return malformed data, addresses are not permanently forgotten as clean; they are re-checked shortly.
• Resolved the potential exposure of API keys in error logging.
• The system no longer loops requests endlessly against rejected API keys or exhausted quotas; a cooling-off period is enforced.

Crawlers & AI bots

• Search engine and AI crawler IP ranges are synced directly from publishers' official sources.
• Addressed spoofed user agents claiming bot privileges; two-way verification is now strictly required before granting exemptions.
• Temporary official source unreachability no longer purges existing verified caches, preventing crawler lockouts.
• Apple Private Relay is no longer generalized using broad subnet masks; all published egress nodes are accurately tracked.
• Removed legacy broad range fallbacks that previously over-extended bot privileges.
• Crawler IP feed synchronizations run in the background without delaying visitor requests.

Online visitors & widget integration

• Added an option to display active search engines and crawler bots in the "Members online" widget.
• Implemented native XenForo 2.3 SVG brand icons for verified crawlers (Microsoft/Bing, Google, Apple, Meta, etc.).
• Integrated an ultra-fast 60-second caching layer for widget bot data, guaranteeing zero additional database queries on page loads.
• Clicking on a bot in the widget now navigates directly to the "Robots" tab and filters active sessions exclusively for that crawler.
• Added a dismissible native filter bar on the Current Visitors list to easily clear or view the active bot filter.
• Resolved empty bot titles on the Current Visitors page; titles are resolved dynamically and rendered in a clean, balanced font size (85%).
• Replaced generic "Viewing unknown page" bot entries with their actual target URLs or challenge verification redirects.

Daily cleanup & maintenance

• The exact cleanup run time and time zone can now be configured directly from the admin panel.
• Daylight saving time transitions no longer cause missed or double maintenance runs.
• Abandoned challenges are cleared during daily maintenance, preventing innocent visitors from remaining blocked.
• Add-on setup and upgrade lifecycles strictly touch only their own settings and never modify third-party add-on configurations.
• Cache purge controls now cover all newly introduced runtime datasets.

This update introduces enhanced protection against modern automated scraping threats while delivering critical stability improvements designed to prevent legitimate community members from experiencing accidental access restrictions.

To counter aggressive automated tools and AI crawlers that rapidly open dozens of discussion threads within seconds, a dedicated "Thread View Burst Rate Limiter" has been implemented. This feature monitors rapid consecutive thread views within a short time window and automatically challenges or temporarily restricts suspicious visitors or compromised accounts before server resources are exhausted. Administrators can freely configure the sensitivity threshold, time window, and choose between presenting a verification challenge or applying a temporary rate-limit cooldown.

Additionally, IP handling for dynamic residential and mobile internet connections has been thoroughly refined. The system no longer permanently restricts IP addresses when a verification challenge is abandoned or left unsolved. This ensures that genuine members who are assigned dynamic IP addresses by their service providers will never face lockouts due to earlier guest activity.

Single-attempt challenge errors no longer result in access restrictions, allowing visitors to retry verification smoothly. Furthermore, if a registered member visits from an IP that had a pending verification from background or unauthenticated requests, the system automatically resolves the status to active upon member authentication.

Configuration diagnostic checks in the administration control panel have been updated to strictly follow XenForo core standards, and text contrast across detail views has been optimized for improved clarity.

Change Log

• Thread View Burst Rate Limiter Added: Implemented a dedicated burst rate limiter to intercept automated bots and AI scrapers rapidly viewing multiple threads within seconds. Configurable threshold and time window with options to trigger a Turnstile / Captcha challenge or temporary rate-limit block.
• Member Account Burst Monitoring: Added an option to monitor regular registered member accounts used by automated scrapers under the thread burst limiter (Administrators and moderators remain fully exempt).
• Dynamic IP Safeguard: Removed permanent restrictions on abandoned or unsolved verification challenges, eliminating false positives for members on dynamic residential and mobile internet connections.
• Challenge Retry Tolerance: Unsuccessful verification attempts no longer result in access restrictions, allowing visitors to retry verification cleanly.
• Automated Member Status Healing: IPs with pending verification states caused by background or unauthenticated requests are automatically healed to active status when a registered member authenticates.
• Configuration Diagnostic Test Refinement: Upgraded interoperability detection to utilize XenForo core active add-on standards, eliminating false positive notices on sites where the companion add-on is not installed.
• Username Badge Legibility: Refined username presentation within detail views to fully inherit XenForo core label color standards, ensuring clear contrast across all displays.

In version 1.1.0, we focused on refining the inspection order, enhancing verification lifecycles, and bringing our diagnostic tools fully up to date.

What is new in this update?

First, we prioritized location and network blocking. Previously, guest dynamic route protection on pages like search and what's new ran before the blocked countries check, which meant visitors from completely restricted countries could receive a verification challenge instead of being stopped dead at the door. With 1.1.0, visitors from blocked countries or networks are immediately stopped with an access denied response without ever reaching a verification screen. Challenges are now reserved exclusively for visitors from allowed regions.

Second, we introduced automated handling for abandoned challenges. Headless scrapers or visitors who abandon the verification screen and attempt further browsing without completing the challenge will now automatically transition to blacklisted status with a clear failure reason. In addition, temporary residential proxy timers are fully safeguarded from being overwritten, and country flags now resolve immediately upon challenge creation.

Lastly, the display warning on the Analytics page has been resolved, and both the Setup Wizard and Test Configuration tools have been updated to reflect all our newest security controls, including automated BotGuard interoperability checks.

Change Log

• Security Execution Order: Blocked Countries, Blocked ASNs, and VPN checks now evaluate before dynamic route protection, ensuring visitors from restricted regions are immediately stopped at the door with a 403 Forbidden response instead of receiving a captcha challenge.
• Analytics Page Resolution: Fixed the undefined array key warning on the admin analytics page and integrated challenged visitors into all traffic breakdown charts and legends.
• Automated Challenge Expiration: Visitors who abandon the verification screen or attempt further requests without solving the challenge within the timeout window are automatically converted to blacklisted status (Challenge Failed / Abandoned).
• Blocked Status Preservation: Pre-existing temporary block statuses and expiration counters (such as residential proxy cooldowns) are now protected from being overwritten by challenge events.
• Country Flag Resolution: Country codes are now resolved and assigned immediately when a challenge is issued, ensuring geographical flags render accurately without generic placeholders.
• Setup Wizard Modernization: Updated Starter, Standard, and Aggressive profiles to include dynamic route protection and immediate block list checks, along with updated summary tables.
• Test Configuration Expansion: Added automated tests for Dynamic Route Challenges, Immediate Block List Enforcement, and BotGuard Interoperability to detect and prevent mutual redirect loops.
• Codebase Health: All file hashes and master data have been re-verified to ensure 100% integrity across XenForo file check standards.

Our main goal with this release is to provide crystal-clear reporting for site owners, eliminate confusing visitor numbers, and ensure harmonious coexistence with other forum security tools.

Seamless Compatibility with Other Security Add-ons
When running alongside other security add-ons on the same forum, visitors encountering a challenge screen could occasionally get caught in browser redirect deadlocks. In version 1.0.50, we have added strict background safeguards on our verification pages. Our challenge process now operates cleanly without triggering unexpected interference from other add-ons, allowing multiple security layers to coexist smoothly.

Accurate Challenge and Visitor Tracking
Previously, visitors who were prompted with a verification check were immediately counted alongside normal active visitors, regardless of whether they solved the challenge or abandoned the page. This occasionally gave forum owners the false impression that suspicious scrapers were browsing the site freely. With this update, challenged visitors are clearly differentiated. When a challenge is issued, it is tracked as such, and only visitors who actually complete the verification are counted as active members of your traffic. This keeps your visitor statistics honest and accurate.

Smart Protection for Resource-Heavy Dynamic Pages
Search queries and recent content streams are typically the most resource-intensive pages on any XenForo forum. To prevent aggressive scraper bots from hammering these dynamic endpoints, we have introduced an optional protection feature. You can now prompt unauthenticated guests with a quick, frictionless verification before they access heavy pages like search or what's new. Once verified, genuine visitors can browse freely without being prompted again for 30 minutes. Registered members and verified search engine crawlers remain completely unaffected.

Upcoming Versioning Scheme
With this release, the 1.0.x series has reached its planned maturity and stability. Starting with our next release, all future updates will follow a streamlined versioning format: 1.1.0, 1.1.1, 1.1.2, and so forth.

Change Log

• Added defensive response headers and cache controls to verification routes to prevent browser redirect loops.
• Implemented automatic interoperability for sites running alongside other security add-ons such as XF Bot Guard.
• Introduced a dedicated challenged visitor status to distinguish between visitors currently verifying and those who completed the check.
• Updated visitor tracking so only visitors who successfully pass verification transition to active status, keeping analytics accurate.
• Added a dedicated challenged filter tab and status metrics in the Admin CP IP List View for quick auditing.
• Added clear status labels across IP detail views to indicate visitors with pending challenge requests.
• Added an optional setting to challenge unauthenticated guests before accessing resource-heavy pages like search and what's new.
• Added an admin option to customize the list of dynamic route prefixes that require guest verification.
• Allowed guests who complete verification to browse protected dynamic routes for 30 minutes without repeated prompts.
• Prepared the versioning roadmap for upcoming releases, which will follow the 1.1.0, 1.1.1, 1.1.2 format.

With the 1.0.49 release, we are introducing a major security and user-experience upgrade designed specifically to solve one of the most frustrating dilemmas forum administrators face: dealing with scraper traffic without locking out genuine international visitors.

You Don't Have to Completely Ban an Entire Country Anymore!
Previously, blocking a country meant shutting the door on everyone from that region with a hard 403 error. In the real world, this is rarely ideal. Countries like France, Spain, or the United States are home to high volumes of automated scrapers and residential proxies, but they are also home to legitimate, valued forum members.

Starting with 1.0.49, you have granular, flexible control:

• Hard Blocked Countries (403 Forbidden): Instantly block traffic from regions you never want on your site (e.g. China, Singapore).
• Challenged Countries (Turnstile / Captcha): Instead of outright banning countries with mixed traffic, visitors are simply presented with a quick verification challenge. Real humans verify in one click and browse freely, while headless scrapers and bots are stopped cold.
• Granular Control for ASNs as Well: Apply the exact same logic to hosting providers and networks (Hard 403 vs. Captcha Challenge).

Smart Priority Hierarchy (Datacenter Scrapers Can't Sneak In)
If you set the United States to "Challenged," what happens when a scraper hits your forum from an AWS or DigitalOcean datacenter located in the US? Our verification engine ensures datacenter rules take strict precedence: because that datacenter ASN is on your blocklist, it receives an immediate 403 Forbidden. Country-level challenges will never downgrade a blocked datacenter bot!

Dynamic Return Redirect & 30-Minute Grace Window
When genuine visitors solve the challenge, they aren't kicked back to your home page—they are seamlessly redirected straight to the thread or page they originally clicked on. Once verified, they enjoy a 30-minute browsing grace period so they never get interrupted on every page click.
[XTR] IP Threat Monitor 1.0.49 Changelog

New Features & Improvements:

• New: Added dedicated Challenged Countries (Turnstile / Captcha) list. Visitors from these countries receive a verification prompt instead of an outright 403 ban.
• New: Added dedicated Challenged ASN List (Turnstile / Captcha) to verify traffic from specific networks with challenges rather than hard blocks.
• Improvement: Smart Priority Hierarchy: Blocked Datacenter ASNs and ProxyCheck detections are evaluated before country challenges, ensuring malicious datacenter scrapers can never bypass a block via country settings.
• Improvement: Dynamic Return Redirect: Visitors who pass the challenge are automatically redirected back to their originally requested thread or page.
• Improvement: 30-Minute Grace Window: Verified human visitors enjoy uninterrupted browsing across the forum for 30 minutes without repeated challenges.
• Improvement: Integrated dynamic return redirects into error-page rate-limiting challenge responses as well.
• Improvement: Verified search engine bots (Googlebot, Bingbot, etc.) and Apple iCloud Private Relay users remain fully protected and exempted from all challenge hurdles.

In this update, we have made significant improvements, particularly regarding Apple privacy service verification, Autonomous System Number (ASN) lookups, and graphical visibility.

Hardened Apple iCloud Private Relay Verification
Following feedback from our community, we identified that an overly broad legacy fallback IP definition was inadvertently allowing certain cloud hosting servers (such as Linode/Akamai VPSs) to be misclassified as Apple Private Relay connections. In v1.0.48, this definition has been completely removed and synchronized exclusively with Apple's official egress IP ranges and verified partner relays. Genuine Apple devices continue to pass smoothly, while automated cloud crawlers and hosting servers are now correctly caught and filtered.

Dedicated Network (ASN) Search & Automatic Data Backfill
The log search engine has been significantly upgraded. Administrators can now search and filter visitors directly by their detected Autonomous System Number (ASN). When upgrading to v1.0.48, the system automatically scans your existing log history and populates network information using the local lookup database. In addition, each log entry now displays its detected network code directly beneath the IP address for quick inspection.

Clarity for Expired Temporary Blocks
To eliminate confusion between currently enforced blocks and past security events: When a temporary block window lapses, the log list now clearly distinguishes it with a muted "Blocked (Expired)" badge with an informative tooltip. Active restrictions remain boldly flagged, giving you instant clarity regarding your forum's live security status.

Trend Chart Mouse-Over Enhancements
Resolved an SVG layer overlap issue on the dashboard trend chart where overlapping blacklisted lines could obstruct mouse hover events over the active visitor line. Administrators can now easily inspect hover statistics across all series without visual interference.

Changelog

Fixes & Improvements

• iCloud Private Relay Hardening: Removed an overly broad fallback CIDR that allowed third-party hosting IPs (e.g. Linode) to be falsely recognized as Apple Relay; aligned strictly with official egress standards.
• Dedicated ASN Column & Accurate Search: Added a dedicated, indexed network column to the threat log database. Administrators can now search and filter logs directly by detected ASN values.
• Automatic Historical ASN Backfill: Upgrading automatically enriches your existing log records with their corresponding network identifiers using the local lookup database.
• Visual ASN Badges: Added clean network identifier badges beneath IP entries in the log view for immediate visibility.
• Expired Block Labeling: Added an informative "Blocked (Expired)" status badge so administrators can easily distinguish between ongoing active blocks and past historical events.
• Trend Chart Hover Resolution: Fixed SVG pointer event obstruction where overlapping blacklisted lines prevented tooltips from triggering on the active traffic line.

This update focuses on delivering smarter protection for residential visitors and refining log filtering within the Admin Control Panel.

Smarter Handling for Home and Mobile Internet Users
Dynamic IP addresses used by home broadband and mobile network providers rotate frequently. Occasionally, an ordinary household connection may temporarily host an unauthorized proxy and get flagged by security lookup services. However, these services also clear such dynamic addresses very rapidly once the issue resolves.

Previously, dynamic home connections were permanently added to the blacklist upon detection, which could unintentionally lock out innocent forum members for extended periods.

With v1.0.47:
Suspicious connections originating from residential or mobile networks are no longer permanently blacklisted. Instead, the system applies a temporary block aligned with modern threat listing lifecycles. As soon as the lookup service clears the address, your visitors automatically regain access without requiring any manual intervention by administrators. Dedicated server attacks, web hosting proxies, and malicious networks remain strictly blocked as always.

Enhanced Active Log Filtering in Admin CP
Based on community feedback, we have enhanced the log filters in the Admin Control Panel. When viewing the "Active" filter, the list now displays both regular active visitors and your trusted IP addresses currently browsing the forum. This gives administrators a complete, unified overview of all permitted ongoing traffic in one single view.

We sincerely thank our community members for their invaluable feedback and continued support!

Changelog

New Features & Improvements

• Smart Residential & Mobile Protection: Transient proxy detections on consumer broadband and mobile networks are no longer permanently added to the blacklist. A temporary block is applied instead, preventing legitimate community members from experiencing accidental long-term lockouts.
• ProxyCheck Caching Guidance Compliance: Cache duration for dynamic residential detections has been aligned with current security lookup guidelines, while clean lookups continue to be cached efficiently to protect your API usage quota.
• Active Log Filter Enhancement: When selecting the "Active" filter in Admin CP Threat Logs, permitted Trusted IPs currently browsing the forum are now included alongside standard active visitors.
• Informative Temporary Ban Reasons: Added dedicated log reason phrases explaining when a connection is temporarily held as a dynamic residential proxy.
• General Stability & Refinements: Optimized finder queries and hardened validation across all log filtering processes.

This maintenance and optimization update focuses on full search engine crawler verification (specifically Qwantbot), eliminating false-positive "Fake Bot" labels, auto-healing verified bots on the fly, and dramatically accelerating the background bot remediation job.

Key Highlights

• Built strictly against official Qwant crawler documentation and daily IP prefixes. Genuine Qwant crawlers are now verified via official subnets and Forward-Confirmed Reverse DNS (FCrDNS), permanently resolving the issue where genuine bots were incorrectly flagged as "Fake Bot".
• If a legitimate, verified search crawler (Google, Bing, Qwant, etc.) carried a historical block or rate-limit violation in the database, the security engine now automatically restores its status to active on its next crawl, clearing old blacklist records and cache transparently.
• The bot remediation tool (xf-rebuild:xentr-ipt-remediate-bots) has been re-engineered with high-performance in-memory CIDR matching and smart User-Agent pre-filtering. A process that previously took hours across tens of thousands of records now finishes in just a few seconds.
• All analytical chart and distribution queries have been upgraded to strict PDO prepared statement parameter bindings, ensuring 100% adherence to XenForo 2.3 coding standards and best practices.

Version 1.0.46 Changelog

• Fix: Resolved a false-positive condition where legitimate Qwant crawlers were incorrectly tagged as [Fake Qwant (Qwantify)] in the ACP Threat Log.
• Improvement: Integrated official Qwantbot IP ranges and dual-stack Forward-Confirmed Reverse DNS (FCrDNS) verification matching official crawler specifications.
• New Feature: Implemented on-the-fly auto-healing for verified search engine bots, restoring historical blacklist and rate-limit violations back to active status automatically upon live visits.
• Performance: Drastically optimized the RemediateBots background rebuilder with in-memory CIDR evaluation and smart User-Agent pre-filtering, reducing processing time on large databases from hours to seconds.
• Security & Standards: Refactored all aggregation and chart queries in the repository to strict PDO prepared statement parameter bindings.

This maintenance and stability update is specifically designed to eliminate upgrade freezes on high-traffic boards with large IP log databases and to ensure seamless crawling for verified search engines.

Key Highlights:

• Instant & Seamless Upgrades: Resolved an issue where forums with extensive threat logs experienced timeouts or "Action pending" screens during upgrades. Add-on updates now complete smoothly within seconds.
• Non-Blocking Background Remediation: Verified search engine crawlers (Googlebot, Bingbot, etc.) and Apple iCloud Private Relay users that may have been caught by ASN rules are now safely restored in the background without impacting forum performance or page speed.
• Rebuild Caches Tool Integration: Administrators can now run this scan at any time directly from the Admin Control Panel under Tools -> Rebuild caches, complete with a real-time progress bar.
• Automated Daily Maintenance: Integrated into the daily maintenance schedule to continuously ensure legitimate web crawlers and privacy relay users never stay blocked.

Change Log

• Fix: Eliminated installer timeouts and upgrade stalls on high-volume boards with large log tables; add-on upgrade now finishes instantaneously.
• New Feature: Introduced a background deferred remediation process to safely restore falsely restricted search engine bots and Apple Private Relay IPs in optimal slices.
• New Feature: Added a dedicated rebuild tool under Admin CP -> Tools -> Rebuild caches with live progress bar support.
• Enhancement: Automated daily cleanup schedule now continuously inspects and unblocks legitimate bots in the background.
• CLI Support: Added direct command-line support (php cmd.php xf-rebuild:xentr-ipt-remediate-bots) for server administrators managing large forums.

We are pleased to announce the release of v1.0.44 for IP Threat Monitor! This update brings crucial improvements designed to safeguard your search engine indexing (SEO), eliminate cloud network dilemmas, and provide granular control over search engine bots.

Key Highlights:

• Search Engines vs. Cloud Scrapers Dilemma Solved:
  Blocking large cloud infrastructure (such as Microsoft Azure to stop aggressive AI scrapers) previously risked affecting legitimate crawlers like Bingbot sharing the same network. With 1.0.44, officially verified search engine bots automatically bypass network (ASN) and country block rules. You can now keep cloud scraper networks blocked with complete peace of mind without hurting your SEO rankings.
• Granular Google Bots & Future-Proof Fallback:
  Instead of a single blanket setting for Google, bot options are now diversified by purpose. You can easily keep standard Google Search indexing active while selectively blocking AI training crawlers (Google-Extended) or R&D scrapers. In addition, a new "Other Bots from Google" fallback option ensures that whenever Google introduces a new crawler in the future, it will pass through safely without waiting for an add-on update.
• Seamless iCloud Private Relay Access:
  Evaluation priority has been optimized so that legitimate Apple iCloud Private Relay visitors are recognized before network filters, ensuring Apple users browse your community without false blocks.
• Automated Historic Remediation:
  Upon upgrading to 1.0.44, the updater automatically inspects historic logs and safely unblocks any verified search crawler IPs that were caught by previous network-level rules, restoring clean indexing instantly.

Changelog

• New: Diversified Google bot settings with granular controls (Google Search indexer, Search Console Inspection, GoogleOther AI, Google-Extended AI training, Ads, and Shopping crawlers).
• New: Added "Other Bots from Google (Fallback / Unlisted)" option to future-proof against new or unlisted Google services without requiring add-on updates.
• Improvement: Verified search engine crawlers (Googlebot, Bingbot, etc.) now bypass ASN and Country filters, preventing false positives when cloud provider ASNs (e.g. Azure AS8075) are blocked.
• Improvement: Prioritized Apple iCloud Private Relay checks before ASN filters to ensure seamless connectivity for legitimate Apple users.
• Improvement: Added automated upgrade remediation to safely unblock verified crawler IPs that were historically caught by network block rules.
• Improvement: Updated and expanded official Google search engine IP network ranges.
• Improvement: Seamless option migration during upgrade to maintain complete protection without configuration reset.