[XTR] IP Threat Monitor [Paid] 1.1.3

[smallwheels]

The experiences with 1.1.3 are (expectedly) positive until now. The number of temporary blocks went straight up after the update, as now most new blocking events seem to rather block than blacklist (which seems a good thing overall).




Existing blacklist entries are obviously still honored, so there is a lot of "blacklisted" still and once more a very old and long blacklist may trigger false positives. Still thinking about getting rid of the historical blacklist for the most part and give it a fresh start - the ASN and country blocking lists that I built up over time should avoid negative effects.

I found one entry that seems to hint at a potential but:



Akkoma/Plemora is whitelisted, yet the IP was blocked. It belongs to ASN 24940 (Hetzner) which is indeed blocked - but the block should be overridden by the whitelisting for the bot. Seems this is not the case, despite the checkbox to apply the whitelist has been set:



When trying to find out if this is a one-time event it turned out that it seems currently not possible to filter the IP list for parts of the user agent (using the search field) or the bot/service that was detected (i.e. also true for iCloud Private Relay).

 

[lantek]

Does this work if the forum is behind AWS CloudFront CDN? Thanks!

 

[Osman]

Does this work if the forum is behind AWS CloudFront CDN? Thanks!

Hi,

Yes, absolutely! [XTR] IP Threat Monitor works completely behind AWS CloudFront (or any other CDN / Reverse Proxy like Cloudflare, Fastly, etc.).

How it works:The add-on does not rely on raw server variables; instead, it utilizes XenForo's native core IP resolution ($request->getIp()). As long as your XenForo installation is configured to recognize CloudFront as a trusted proxy and resolves the real client IP (via X-Forwarded-For), the add-on will accurately detect, log, challenge, and block real visitor IPs, ASNs, and countries.

Quick Tip for CloudFront:Ensure your origin server (Nginx/Apache) or XenForo's src/config.php is configured to trust reverse proxies. For instance, in XenForo's src/config.php:

$config['http']['trustedProxyHeaders'] = ['X-Forwarded-For'];

(Or configure real_ip in Nginx / mod_remoteip in Apache with CloudFront's IP ranges).

Once XenForo sees the actual visitor's IP, all rate limiting, bot verification, and threat mitigation features in IP Threat Monitor will work seamlessly.

 

[Elisabeth_K]

I checked in today with half a dozen of these.


Error: Call to undefined method XENTR\IPThreatMonitor\Service\RateLimiter::getVpnOrProxyBlockReasonMessage()
src/addons/XENTR/IPThreatMonitor/Pub/Controller/RateLimitCaptcha.php:46
Generated by: Unknown account Nov 3, 2026 at 11:05 AM

#0 src/XF/Pub/Controller/AbstractController.php(51): XENTR\IPThreatMonitor\Pub\Controller\RateLimitCaptcha->preDispatchController('Index', Object(XF\Mvc\ParameterBag))
#1 src/XF/Mvc/Controller.php(140): XF\Pub\Controller\AbstractController->preDispatchType('Index', Object(XF\Mvc\ParameterBag))
#2 src/XF/Mvc/Dispatcher.php(363): XF\Mvc\Controller->preDispatch('Index', Object(XF\Mvc\ParameterBag))
#3 src/XF/Mvc/Dispatcher.php(266): XF\Mvc\Dispatcher->dispatchClass('XENTR\\IPThreatM...', 'Index', Object(XF\Mvc\RouteMatch), Object(XENTR\IPThreatMonitor\Pub\Controller\RateLimitCaptcha), NULL)
#4 src/XF/Mvc/Dispatcher.php(121): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(XENTR\IPThreatMonitor\Pub\Controller\RateLimitCaptcha), NULL)
#5 src/XF/Mvc/Dispatcher.php(63): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#6 src/XF/App.php(2840): XF\Mvc\Dispatcher->run()
#7 src/XF.php(850): XF\App->run()
#8 index.php(23): XF::runApp('XF\\Pub\\App')
#9 {main}

Request state

array(4) {
  ["url"] => string(69) "/xen/rate-limit-captcha/?_xfRedirect=/xen/whats-new/posts/5566/page-3"
  ["referrer"] => string(23) "https://citadel-81.com/"
  ["_GET"] => array(1) {
    ["_xfRedirect"] => string(32) "/xen/whats-new/posts/5566/page-3"
  }
  ["_POST"] => array(0) {
  }
}

Country flags have all gone wonky


- eta -