[XTR] IP Threat Monitor [Paid] 1.1.1

[Osman]

I have no issues and will sleep better at night knowing everything is working perfectly. Thank you so much!

You're very welcome Elisabeth, happy to hear that!

 

[Osman]

All is well today but I have a question about the IP Threat Monitor cleanup cron job.

I wasn't sure it was working so I ran it manually. It cleared out the stale entries in challenged but the expired ones in blocked are a couple days old.

Is this how it is supposed to work?

Yes, that is exactly how it is designed to work, Elisabeth!

The challenged entries are temporary verification attempts; if someone abandons them for more than 15 minutes, the cron purges them immediately so dynamic IPs aren't trapped.

For blocked entries, once the blocked_until time expires, the IP is no longer restricted and can freely access the site again. However, the record itself is kept in your log table as a historical audit record so you can track past threats and statistics. Those are retained according to your Log Retention setting (default is 30 days, which you can adjust in the add-on options or clear via the Prune tool).

 

[Elisabeth_K]

Is it possible to change the time the cleanup cron job runs? It won't let me change it and 8:00 PM removes things I still want to see. I'm in GMT -7. In the next release, maybe keep the 3:00 AM time the same but have it based on local time, not UTC?

Thanks!

 

[smallwheels]

@Osman : I think we might need another update that needs some rework: I am currently preparing moving my forum to a VPS and did install a clone of my forum there for testing purposes. Much to my surprise some time later I found the IP of that VPS in the dashboard of Proxycheck, declared as VPN (which it clearly isn't), and, as a consequence, also blacklisted in IP Threat Manager:



What had happened is that I clicked on a thread in the cloned forum and this thread had a quote with a picture inside. The link in that quote to that picture used the full original URL and so there was a request sent from the VPS to my original forum. I asked the proxycheck support why my IP was falsely declared as a VPN and and on which foundation these declarations are made, given that the VPS had been set up freshly, had no history, the declaration of proxycheck came in real time when the request happened with the according date stamp for the declaration and there was no interaction with the VPS from proxycheck. The answer left me somewhat baffled:

When it comes to our v2 API, all hosting IP’s have been set as VPN’s.

This seems a bit of a bummer, leading potentially to quite a bunch of false positives. Though the reasoning behind it is somewhat understandable:

This is because when the v2 API was launched around 10 years ago our thought process was, if an IP is interacting with your website or service from a datacenter IP, it’s very (extremely likely) to be a VPN or a bot performing automated actions. Bot things undesirable if you want to block VPN’s you likely want both of those blocked.

But clearly, this seems quite some cheating, claiming to have exact information when in fact there is none at all. However, there is a way out:

Now though, in our newer v3 API which launched in a public beta in August 2025 and went stable in June this year, it has the capability to show both hosting and VPN’s separately and we no longer upgrade hosting addresses to VPN’s in the response, instead we only list an IP as a VPN if we’re 100% certain it’s a VPN, whether it’s also a hosting address or not.

Our own webpages (Web interface, lookup page, homepage etc) all now use our v3 API since the beginning of this year which is why there is a discrepancy when checking this IP address. In addition the v3 API gives a lot of VPN specific information now like who is actually operating the address behind the VPN.

So it would possibly be good to switch IP Threat Monitor from Api V2 to V3 and make use of the new possiblities. One question would be how to deal with unknown hosting IPs, that are not verified to be a Proxy/VPN/whatever in future.

On the other hand: I do effectively and deliberately block most server ranges with very few exceptions anyway. No complaints so far since using IP Threat Monitor. So probably not really a huge problem, especially given the exceptions IP Threat Monitor offers for Search Engines, Social Networks and logged in Users. I would not have noticed the issue it if not my own server was affected. Still, I find the "VPN" statement really misleading.

 

[Abraham54]

I think this tool is the solution for my forum, but I can not buy this.
Because paying with PayPal is not possible.