[XTR] IP Threat Monitor [Paid] 1.1.1

[Anthony Parsons]

One rule set to manage challenge everything outside Australia: (not ip.geoip.country in {"AU"}) and to be honest, you could just block everything outside Australia for a footy site such as yours.

 

[Dannymh]

Don’t know what to tell you mate, I’ve been fighting this for about 12 months and try whole country blocks. Rules that set the challenge for specific countries but they just move the country, have had all the main offenders, however it just rotates out after blocking those so I end up with Australia being a huge location for spammers, have even had the likes of Brazil, Finland, Vietnam, random African countries. It’s a constant battle and ultimately the only thing that has solved it thus far after numerous attempts and tactics is the blanket cloudflare under attack setting. Not ideal but it’s the best solution thus far for me

 

[Dannymh]

One rule set to manage challenge everything outside Australia: (not ip.geoip.country in {"AU"}) and to be honest, you could just block everything outside Australia for a footy site such as yours.

You would think that but the second I put whole country blocks in place I had members emailing me who lived in those countries. Majority of or traffic comes from Australia however we have members in lots of south East Asian countries, all over Europe, us Canada and South America. So entire country blocks always end up dudding someone.

I myself lived overseas for many years.

So I appreciate the ideas but as I said I’ve tried everything and all solutions are flawed and so far the only thing that causes the least disruption and works is under attack mode

 

[Levina]

I have installed the add-on two days ago and it works well. But I'm seeing countries like Bangladesh and Hong Kong in the list of current guests and I have blocked them. So, how come I'm seeing them?

 

[smallwheels]

I'm seeing countries like Bangladesh and Hong Kong in the list of current guests and I have blocked them. So, how come I'm seeing them?

If it does happen only occasionally it may be a glitch in the matrix: IPs get reassigned quite frequently, either from one ASN to another or to a different location within an ASN. IP geolocation is not an exact science anyway plus the free version of the maxmind db may have some delays from time to time, the more as it is downloaded only every couple of days. Also, sometimes announcements of the IP owners are bogus, missing or simply wrong - deliberately or accidentally. All of that is typically not a huge issue (and temporary anyway), but it may be the explanation of what you see.

I.e. I've blocked Brazil completely, yet today I had an IP from there in my proxycheck logs (which usually is not the case due to the country blocking):

 

[Levina]

If it does happen only occasionally it may be a glitch in the matrix: IPs get reassigned quite frequently, either from one ASN to another or to a different location within an ASN. IP geolocation is not an exact science anyway plus the free version of the maxmind db may have some delays from time to time, the more as it is downloaded only every couple of days. Also, sometimes announcements of the IP owners are bogus, missing or simply wrong - deliberately or accidentally. All of that is typically not a huge issue (and temporary anyway), but it may be the explanation of what you see.

I.e. I've blocked Brazil completely, yet today I had an IP from there in my proxycheck logs (which usually is not the case due to the country blocking):

View attachment 338882

I don't know if it's a glitch or something else but for some reason Hong Kong and Bangladesh keep appearing in the list of visitors.

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.31

Release Notes:

This release aims to resolve a rare race condition error that could occur during the cleanup of cache files, particularly on Windows Server and high-traffic environments. Thanks to architectural improvements, manual cache clearing operations or intensive cron tasks will no longer trigger false warnings in the Server Error Logs. As this update does not involve any database or template changes, it can be safely updated by simply overwriting the files.

...

Read the rest of this update entry...

 

[Wildcat Media]

@Osman, have you ever looked into this as an alternative to proxycheck.io?

https://blackbox.ipinfo.app/

The ipinfo.app site has a lot of useful API utilities, and they are completely free to use. For instance, it would be a nice XF feature if, in addition to IP address in current visitor lists showed the ASN and owner, location, and other info provided by the my.ipinfo.app API. (With caching of course, so repeat visitors aren't continually hitting the ipinfo.app API.) Or, replace the IP lookup with a link to this particular app vs. going to whatismyipaddress.com (which doesn't work for us--XF adds a forward slash to the IP address, a bug that's never been fixed).

 

[Wildcat Media]

Actually, they do have a paid tier, so....I guess this isn't an option after all.

No API key required for most services. Blackbox has free tiers; higher-volume access requires a RapidAPI key.

But I haven't had time to see what that costs.

 

[C.Munroe]

Hey, just wanted to say thank you for the shoutout for ipinfo.app.

I saw your notes about blackbox.ipinfo.app being paid. Only the v2 endpoint is paid currently. v3 will eventually be paid, but currently free in beta.

v1 however is totally free and is processing multiple hundreds of millions of requests per month.

We made the v2/v3 instance to provide more data and catch some edge cases that can't be captured in a (Y/N/E) response. Additionally, the rapidapi runs on its own dedicated instances for when the free v1 instance gets saturated.

Side note, v2 has a free tier that can be accessed if you have a smaller forum that needs less than 1,000 lookups a day (which I believe to be most).

Tag me if you have any other specific questions, or needs. Thanks again for the shoutout.

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.32

This is a critical maintenance update released to ensure our add-on operates flawlessly with the recently rolled-out XenForo 2.3.12 version.

In XenForo 2.3.12, the core developers introduced highly strict rule changes to the underlying "Class Extension (Class Proxy)" mechanism (specifically concerning stripped alias merging). These changes broke backward compatibility, causing features that worked perfectly in previous versions to suddenly trigger crashes (Fatal Errors) or silent...

Read the rest of this update entry...

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.33

This maintenance and quality-of-life update enhances the "IP Activity by Time" monitor on the admin dashboard.

In previous versions, activity distribution was aggregated based on the database server's default timezone (typically UTC). With version 1.0.33, the dashboard automatically adapts to the viewing administrator's local timezone configured in their XenForo account. Threat activities occurring throughout the day (Night, Morning, Day, Evening) are now accurately mapped to...

Read the rest of this update entry...

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.34

With this update, we are thrilled to bring one of the most requested features to life, along with an important data mapping improvement!

New Feature: Country Whitelist (Allowlist) Mode
You no longer need to manually add dozens or hundreds of countries to a block list!
With the newly introduced "Country Filter Mode", you can now switch the country filter to Whitelist Mode. In this mode, only visitors originating from your selected countries (e.g., US, Canada, UK) will be...

Read the rest of this update entry...

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.35

This update focuses on internal security hardening, administrative permission consistency, and navigation permission alignment in accordance with XenForo 2.3.x core standards. All improvements have been implemented without altering the high-performance cache-first architecture or core rate-limiting workflows.

---

• Security Hardening:
  • Hardened the client validation check in the Rate Limit Captcha controller (RateLimitCaptcha.php). Replaced...

Read the rest of this update entry...

 

[Ron Natalie]

IP THREAT MONITOR went bonkers on my site completely filling the disk with multiple gigabytes of data in ip_threat_cache. It's so much of a mess I can't even run ls or rm -fr in any sane amount of time. There's a gazillion tiny files of the form

./ad96adeef3ebe3fe8d8799af6f9848bc.cache

 

[Osman]

Hello,

Thank you for reporting this. Since this issue appears to be related to the IP Threat Monitor generating a very large number of cache files, we need to investigate the cause in detail.

Please open a support ticket on our website and include the errors you are receiving, along with any relevant details about the issue. This will allow us to review the problem properly and investigate what is causing the excessive ip_threat_cache files to be generated.

You can create a support ticket here:

https://xentr.net/support-tickets/

Please provide as much information as possible in the ticket, including any error messages or logs you have available.

Thank you.

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.36

We are delighted to announce the release of IP Threat Monitor 1.0.36! This update focuses heavily on real-world stability, server storage efficiency, and deep alignment with the XenForo 2.3 ecosystem based on direct feedback from our customers.

• Smart Storage & Disk Optimization:
  We completely revamped the file-based caching mechanism to eliminate disk clutter and folder slowdowns. Cache files are now neatly organized into balanced subdirectories, and expired temporary...

Read the rest of this update entry...

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.37

This update focuses heavily on real-world reliability, ensuring that your community remains protected and smooth even during sudden visitor traffic spikes, while keeping your search engine presence completely safe.

What's New in Version?

• Rock-Solid Stability During Traffic Surges:
  We refined our background monitoring engine to eliminate any friction or conflicts when hundreds of visitors hit your forum at the exact same moment. The protection runs...

Read the rest of this update entry...

 

[Osman]

Osman updated [XTR] IP Threat Monitor with a new update entry:

1.0.38

In this version, our primary focus has been maximizing system security, preserving forum speed and server resources, achieving seamless visual compatibility with XenForo 2.3, and incorporating valuable user feedback to make administration even smoother.

Key Highlights​

1. Advanced Fake Bot Protection
A strict verification mechanism has been implemented to prevent malicious actors and scrapers from bypassing rate limits by spoofing legitimate search engine...

Read the rest of this update entry...

 

[mrdoitnyce]

This product has blacklisted my IP for no reason. I reached out to him for further clarification. Started happening ever since his site required 2FA authentication. (tons of evidence provided to him).

I reached out out to him regarding this issue, first telling its suspicious ip activity, then another time telling me someone else used my XF token to register another account. If i used my url and xf token to already register an account with his site since i first got my XF license, how can his site allow someone else to register another account? Doesnt make sense.

when he told me that, I proceeded to let him know if that happened, it wasn't me, please remove that. I've only ever had 1 username, 1 xf token and 1 email. Anyways, He ignored me afterwards despite sending a few more attempts over time.

Only reason I'm leaving this here is because now i work with people doing custom addons for and other sites where i buy addons from and i cant access any of them because, ipthreatmonitor has determined I'm apparently a threat.