[XTR] IP Threat Monitor [Paid] 1.0.23

[smallwheels]

• Fixed an issue where saving settings (Blocked ASNs, Countries, etc.) would fail with invalid input. Invalid entries are now gracefully stripped.

The Problem ist that every comment input in the ASN-List is stripped. Even the exact example from the settings page:

You can add comments with #: AS12345 # DigitalOcean

If you put this into the ASN List "AS12345" will be saved, "# Digital Ocean" will be cut

 

[smallwheels]

@Osman: A question regarding ASN and country blocks:

• below the ASN list there is stated "Items in this list will be permanently blacklisted upon first violation." I had expected that ASNs listed here would be permanently blocked - seems way more useful to me. The more as with the actual distributed scraping via resident proxies barely any IP will ever hit the violation limit, thus the ASN block it it's current state as I understand it does not deliver value to me. Could you make "permantent blocking" of ASNs as standard make at least an optional setting / checkbox?

• with country blocks the settings page states "Traffic from these locations will be permanently blocked. Requires: VPN/Proxy detection must be enabled to resolve country codes." So from my understanding countries in the list will be blocked permanently, independent from a violation. This does not seem to be the case - I see loads of visitors from countries that have been blocked in the country list. Also, despite having enabled VPN-Check and added the Proxy.io API Key as required it seems there are no country checks made as the API Dashboard at proxy.io states no queries:



The key ist however functional: To test I turned on the "Check all visitors for country flag" in general settings and see some queries coming in.

Is there a reason to go for proxychec.io for the country check instead of using i.e. the free maxmind database that could be saved locally and frequently updated as other add ons do it?

 

[smallwheels]

Since I've checked this box:

.. the Dashboard has stated to populate, before that it was empty. However, this will probably eat up my free queries pretty quickly. But where would this country flag then be displayed? I'd have expected it in the Dasboard/IP-List, but it isn't there.



Also the "top threat countries" are rather "top visitor countries", the more as nothing has been blocked... AR is in my list of blocked country codes, yet it isn't blocked. Could you explain how this is intended to work?

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.23

• Feature:Added Force API Check for Block Lists option. Ensure immediate blocking of visitors from banned Countries/ASNs by forcing an API lookup on their first visit, regardless of the VPN check mode.
• Bug Fix: Addressed a logical issue in "Top Threat Countries" dashboard stats where legitimate visitors were incorrectly included in the count. It now strictly reflects Blocked and Blacklisted IPs.
• Bug Fix: Fixed a critical "Call to a member function...

Read the rest of this update entry...

 

[Anthony Parsons]

Did this update fix this issue I'm getting? I have about 1300+ of them in the past few hours. I unchecked the apple private relay, saved, checked it again, saved, and then all good, it started blocking VPN's again.

Server error log
ErrorException: Fatal Error: Allowed memory size of 268435456 bytes exhausted (tried to allocate 4096 bytes) src/addons/XENTR/IPThreatMonitor/Service/ApplePrivateRelayIPs.php:82
Generated by: Unknown account Feb 2, 2026 at 8:25 PM
Stack trace
#0 [internal function]: XF::handleFatalError()
#1 {main}
Request state
array(4) {
  ["url"] => string(24) "/posts/1766173/reactions"
  ["referrer"] => bool(false)
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(0) {
  }
}

 

[Osman]

Did this update fix this issue I'm getting? I have about 1300+ of them in the past few hours. I unchecked the apple private relay, saved, checked it again, saved, and then all good, it started blocking VPN's again.

Server error log
ErrorException: Fatal Error: Allowed memory size of 268435456 bytes exhausted (tried to allocate 4096 bytes) src/addons/XENTR/IPThreatMonitor/Service/ApplePrivateRelayIPs.php:82
Generated by: Unknown account Feb 2, 2026 at 8:25 PM
Stack trace
#0 [internal function]: XF::handleFatalError()
#1 {main}
Request state
array(4) {
  ["url"] => string(24) "/posts/1766173/reactions"
  ["referrer"] => bool(false)
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(0) {
  }
}

Hi,
Yes, this issue has been fixed in version 1.0.24 which is now available.

What happened: Apple's Private Relay IP list has grown to ~287,000 entries. The previous code loaded this entire list into memory at once, causing the "memory exhausted" error you experienced.

What we fixed:

• Implemented stream-based parsing (reads in small chunks instead of all at once)
• Added IPv6 prefix deduplication (reduced from 245K to ~25K entries)
• Added lock mechanism to prevent concurrent API calls

Result: Memory usage reduced from 32+ MB to virtually 0 MB.

Action required:

1. Update to version 1.0.24
2. After updating, toggle the "Allow iCloud Private Relay" option off and on again to regenerate the cache

The error should not occur anymore. Thank you for reporting this issue!