[XTR] IP Threat Monitor 1.1.1

Fixed: Duplicate entry database errors

• Resolved race condition issues in blacklistIP(), blockIP(), and trustIP() methods
• Improved concurrent request handling with proper error recovery
• Enhanced database integrity with unique constraint protection

Fixed: PHP 8+ compatibility warnings

• Eliminated string offset cast warnings in IPv6 CIDR validation
• Added proper bounds checking for binary string operations
• Updated CloudflareIPs and RateLimiter services

Code Quality Improvements

• Enhanced error handling with try-catch blocks
• Improved entity creation logic to prevent duplicate entries
• Optimized performance by reducing unnecessary database operations

This critical update fixes severe production errors that were causing database exceptions and PHP warnings on live servers.

What's Fixed:

• MySQL duplicate entry errors for IP addresses (Error 1062)
• PHP 8+ string offset cast warnings in Cloudflare IP validation
• Race condition handling for concurrent requests
• IPv6 CIDR range validation accuracy

Impact:
These fixes eliminate all server error log entries related to IP Threat Monitor, ensuring smooth operation on production environments.

• [New] Added "Enable Bot rDNS Verification" option to validate search engine bots via reverse DNS lookup and prevent User-Agent spoofing.
• [Improvement] Enhanced logic for "Block Only (No Captcha)"mode:
  • Initial threshold breach triggers a standard 429 Too Many Requests response.
  • Persistent attacks after the 429 warning now result in a permanent 403 Forbidden ban.

This update introduces critical security enhancements to the bot verification process and improves the blocking logic for aggressive requesters.

New Feature: Bot rDNS Verification We have added a new security layer to prevent User-Agent spoofing. The "Enable Bot rDNS Verification" option ensures that visitors claiming to be major search engine bots (Googlebot, Bingbot, Yandex, etc.) are legitimate.

• How it works: It performs a Reverse DNS (rDNS) lookup to verify the hostname.
• Why it matters: Attackers often spoof User-Agent headers (e.g., pretending to be "Googlebot") to bypass rate limiting. This feature blocks those attempts effectively.