How are you blocking AI scrapers that use regular member accounts?

[smallwheels]

I tested it with Tab AI using a regular logged-in account. It opened 10 threads in 8 seconds. Bot Guard recorded all the requests, but they scored only 30, below the challenge threshold of 50.

You can adjust the scoring and criteria granually, however: I don't think it is the right tool for the job.

That's the part I'm struggling to find a solution for.

To be able to find a solution you have to understand the problem first. This includes to find out how exactly the "attacker" did what he did. I.e. what tools he used and if he i.e. used one dedicated host/IP for the process or in opposite a bunch of rotating proxies. W/o this knowlege it will be hard to develop a specific solution that goes deeper than a rate limiter.

And since I'm on XenForo Cloud with their domain, I can't configure Cloudflare rules myself.

Sadly, on XF Cloud your arms and legs are probably somewhat tied together as you probably only will have very limited logs (i.e. no direct web server logs) and a very limited tool chain as well. I'm not sure that CF would offer a solution, but given the cost of XF Cloud the cost for a own, dedicated domain for your forum should be neglectible. Especially, if this would help to solve the issue.

 

[Anthony Parsons]

Blocking known AI crawlers makes sense, but would that really stop someone using Tab or another AI agent through a normal Chrome browser, logged in with a regular account?

If you're blocking all AI agents, then yes, regardless how someone uses the interface, the crawler is still the same.