addon 2.x Advanced Traffic Statistics: Live Radar, WAF & AI Security 1.9.2

Advanced Traffic Statistics 1.9.2

A major update to bot protection and reliability, developed across the 1.9.x cycle. It adds a powerful new detection layer against modern scrapers, full Cloudflare / reverse-proxy support, and migrates the GeoIP engine to a freely redistributable database. Everything is summarised below.

---

Datacenter (ASN) Detection

Modern scrapers are hard to catch: they run headless browsers with perfect user-agents and valid headers, sailing past traditional checks. But they almost always run on datacenter IPs, while real visitors come from residential or mobile networks. This turns that into a detection signal.

• Detects datacenter traffic from AWS, Google Cloud, Azure, DigitalOcean, Hetzner, OVH, Vultr, Linode, Contabo, Oracle and more.
• Configurable trust-score penalty — datacenter visitors have their trust score reduced and can be flagged as bots. Available to all users.
• Hard-block mode (Pro) — Pro license holders can block datacenter traffic outright with a 403 response. Off by default.
• Verified crawler exemption — Googlebot, Bingbot and other legitimate crawlers that pass Forward-Confirmed reverse DNS are never penalised, even from datacenter IPs.
• Logged-in users are always exempt — a member on a VPN is never affected.
• Lite & Full modes — works out of the box in Lite mode (major clouds). For full coverage including smaller hosts and VPN infrastructure (DataCamp, M247 and others), an optional free database can be added — instructions are shown right in the option.
• Dedicated dashboard panel — shows flagged/blocked counts, a persistent 7-day history, and a live table of recent datacenter visitors with country, trust score, block status, hit count, the user-agent they were pretending to be, and a direct AbuseIPDB lookup link on every IP.

---

Enabling full datacenter protection (optional)

By default, Datacenter Detection runs in Lite mode, covering the major cloud providers (AWS, Google Cloud, Azure, DigitalOcean, Hetzner, OVH, Vultr, Linode, Contabo, Oracle). This already stops most datacenter-based scrapers.

For full protection that also detects smaller hosting providers and VPN infrastructure (DataCamp, M247 and many others), add the optional DB-IP ASN Lite database:

1. Download the MMDB format from https://db-ip.com/db/download/ip-to-asn-lite
2. Decompress the .gz file
3. Rename it exactly to dbip-asn-lite.mmdb
4. Upload it via FTP to the folder src/addons/Statistiche/_data/

The database is free (CC-BY licensed) and updated monthly. Without it, detection still works normally in Lite mode. This database is not bundled with the add-on to keep the package lightweight and fully compatible with all hosting environments, including XenForo Cloud.

---

Cloudflare & reverse proxy support

• Real visitor IP recovery — forums behind Cloudflare now see visitors' real IPs instead of Cloudflare's, so statistics, geolocation and datacenter detection all work correctly. The CF-Connecting-IP header is only trusted when the connection genuinely originates from a verified Cloudflare range, preventing header spoofing.
• Works with existing setups — if your server already restores real IPs (mod_remoteip / nginx real_ip), the add-on detects this and does nothing, avoiding any conflict.
• Admin warning — if the add-on detects it's seeing Cloudflare IPs without the real visitor IP, it alerts the admin with instructions to fix it.

---

GeoIP engine migrated to DB-IP

The country database has been migrated to DB-IP Lite (Creative Commons licensed), which can be freely redistributed within the add-on, ensuring full licensing compliance. Attribution is displayed on the statistics page as required. For most users the change is invisible — country detection works exactly as before, and now functions on every hosting environment including XenForo Cloud, with no server configuration or PECL extension required.

---

Reliability & accuracy

• Persistent 7-day statistics — datacenter history is now stored in a daily archive, so the weekly figures stay accurate regardless of how aggressively old logs are pruned. (Note: the 7-day figure fills in progressively over the first week after updating.)
• Cleaner dashboard panel — the recent-visitors table shows the latest entries with a "View all in Live Radar" link for the full list, keeping the panel tidy even when thousands of IPs are blocked.

---

Removed — Bot Honeypot Trap

The Bot Honeypot Trap has been removed, as it did not deliver the expected results: modern scrapers no longer blindly follow hidden links, so in real-world use it caught virtually nothing. Its role is now filled far more effectively by the new Datacenter Detection above. The related options and template modification are removed automatically on upgrade — no manual cleanup needed.

If you had enabled the honeypot, you can now safely remove these two lines from your robots.txt, as they are no longer used:

Code:

Disallow: /statistiche/Basic/trap
Disallow: /statistiche/trap

---

Upgrade notes

1. Upload and run the upgrade from the Add-ons page. Database changes are applied automatically and the upgrade is safe on live boards.
2. Datacenter Detection is off by default — enable it when ready, starting with the trust-score penalty before considering hard-block mode.
3. If your forum is behind Cloudflare or another CDN, ensure real visitor IPs are being restored (the add-on can do this automatically — see the Cloudflare option in the settings).
4. For full datacenter coverage beyond the major clouds, follow the instructions shown in the detection option to add the optional free ASN database.

Thanks to everyone who tested and provided feedback throughout the 1.9.x cycle. Enjoy the update!

In this update, we've introduced an experimental active defense feature (the Honeypot Trap), a significant hardening of the bot verification engine, and a structural fix that attempts to make the add-on compatible with XenForo Cloud by restoring GeoIP resolution on every hosting environment.

NEW — Bot Honeypot Trap

The add-on can now actively hunt bad bots instead of just watching them.

• Invisible trap link — When enabled, an invisible link is injected into your page footer. Legitimate crawlers (Googlebot, Bingbot, etc.) ignore it thanks to rel="nofollow" and robots.txt; aggressive scrapers that follow every link fall straight into the trap.
• Instant application-level ban — Any bot caught by the trap is immediately flagged and banned: every subsequent request from that IP receives a 403 Forbidden for a configurable duration (default 60 minutes).
• Works everywhere, zero configuration — The ban engine uses the XenForo object cache when available (Redis, APCu, Memcached) and transparently falls back to a database check otherwise. It works out of the box on shared hosting and on XenForo Cloud. No server configuration required.
• Safe by design — Registered users and whitelisted IPs can never be trapped, even if they open the trap URL directly.
• New Honeypot dashboard panel — A dedicated panel on the statistics page shows bots caught today, catches over the last 7 days, currently active bans, and a live table of the most recent catches with IP, country, ban expiry and hit count.
• Two new options: Enable Bot Honeypot Trap and Honeypot ban duration (minutes).

Important: after enabling the trap, add this line to your robots.txt so well-behaved crawlers stay clear of it:

Code:

Disallow: /statistiche/Basic/trap
Disallow: /statistiche/trap

And if you want to test the trap yourself, do it from a different IP (e.g. your phone on mobile data) or add your own IP to the whitelist first — otherwise you will lock yourself out for the configured ban duration. The trap makes no exceptions for admins browsing as guests. That's the point.

HARDENED — Bot verification engine

• Full FCrDNS verification — Spoofed-bot detection now performs Forward-Confirmed reverse DNS: after the reverse lookup, a forward lookup confirms the hostname actually resolves back to the visiting IP. This closes a known technique where attackers set a fake PTR record (e.g. ending in .googlebot.com) to impersonate legitimate crawlers. Verification results are cached for 24 hours, so there is no performance impact.
• CIDR support in the IP whitelist — The whitelist now accepts full network ranges in CIDR notation, both IPv4 and IPv6 (e.g. 192.168.0.0/16 or 2a06:98c0::/29), alongside single IPs. Perfect for whitelisting Cloudflare or your office network in one line.

FIXED — XenForo Cloud compatibility & GeoIP

• The bundled MaxMind GeoIP library is now registered through XenForo's native composer autoload system (composer_autoload directive). This resolves the "may not be compatible with XenForo Cloud" error some Cloud users experienced during installation.
• As a direct consequence, GeoIP country resolution now works on every hosting environment, with no PECL extension required. If your visitor countries were showing as "??", they will start resolving correctly after this update.

PERFORMANCE & RELIABILITY

• Blocked-traffic statistics now use a dedicated indexed column instead of text pattern matching. Dashboard, widget, threat map and daily reports are noticeably faster on large boards (the upgrade migrates existing data automatically — no action needed).
• The "View Live Traffic Radar" permission is now correctly registered: moderators and other user groups granted the permission can access the radar as intended. Note: after upgrading, please re-check this permission in your user groups, as it may need to be re-assigned.
• The threat map no longer alters the global PHP timezone, avoiding potential side effects with other add-ons.

SECURITY

• CSV exports are now hardened against CSV/formula injection when opened in Excel or other spreadsheet applications.
• The AI report API key is now sent via HTTP header instead of the request URL, so it can no longer appear in server or error logs.

Upgrade notes

1. Upload the files and run the upgrade from the Add-ons page as usual. Database changes are applied automatically and the upgrade is safe to run on live boards.
2. Re-check the "View Live Traffic Radar" permission for your staff user groups.
3. If you enable the new Honeypot Trap: add the robots.txt line above, and whitelist your own IP before testing.

As always, thanks to everyone reporting issues and suggesting features — the Cloud compatibility fix in particular came directly from your reports. If you run into anything, post here or reach out via the support contact.

Enjoy the hunt.

Minor bug fixes and compatibility with xenforo 2.3.11

This release brings a massive upgrade to our AI Radar's detection capabilities against modern headless scrapers, along with a critical fix for the geolocation system.

A special thanks to the community (especially user Walter) for the deep code review and invaluable suggestions that made this update possible.

SECURITY UPDATES (PRO)

• Advanced Spoofing Detection: Modern scrapers often fake Google Chrome User Agents to bypass standard security. The Radar AI now checks for HTTP_SEC_CH_UA (Client Hints). If a bot claims to be Chrome but fails to provide valid Client Hints, its Trust Score is instantly destroyed, and it gets blocked.
• Lazy Scraper Penalty: Added severe Trust Score penalties (-90) for requests with completely empty User Agents, instantly blocking low-effort CLI scripts.
• Outdated Browser Trap: Requests claiming to be very old versions of Chrome (pre-v110) are now heavily penalized, as these are typical signatures of unmaintained scraping libraries.

FIXES & IMPROVEMENTS

• GeoIP Dependency Fix: Fixed a silent bug where the MaxMind GeoIP reader class was missing from the package. The add-on now natively includes the required Composer library (maxmind-db/reader). Geolocation and country flags will now work instantly and out-of-the-box for all servers, including shared and cloud hosting environments, without requiring manual Composer installations.

This is a targeted maintenance release focusing on the AI Daily Security Report system, ensuring perfect synchronization with your community's local settings.

FIXES & IMPROVEMENTS

• Timezone Synchronization Fix: Resolved an edge-case bug where the date of the AI Daily Report could misalign (shift by one day) depending on the server's UTC time versus the forum's local timezone. The report now accurately reflects the exact 24-hour period based on the specific timezone set in your XenForo options.
• Native Date Localization: The AI Report no longer uses a hardcoded international date format (YYYY-MM-DD). It now intelligently reads your XenForo Language settings and natively formats the dates inside the generated report according to your community's specific locale preferences.
• UI Clean-up: Removed redundant date headers in the generated threads for a cleaner, more professional look.

This release focuses on significantly expanding the Radar's ability to recognize the newest web crawlers, particularly those related to AI training, while improving overall add-on stability.

SECURITY & DETECTION ENHANCEMENTS

• Massive Bot Definitions Update: Added over 40 new signatures to the default configurations. The Live Radar can now flawlessly detect and categorize the latest AI data scrapers (such as GPTBot, ClaudeBot, OAI-SearchBot, Bytespider), modern SEO scanners, and network vulnerability bots (like Nuclei or Zgrab).
• Enhanced Anti-Spoofing: Expanded the DNS verification map. The system will now actively block malicious connections attempting to spoof legitimate AI models or search engine bots.

FIXES & IMPROVEMENTS

• Known Bugs Fixed: Applied various under-the-hood optimizations and resolved minor known bugs in the traffic to ensure maximum stability and zero interruptions during the page load process.

IMPORTANT NOTE FOR UPGRADING USERS Because XenForo safely preserves your custom option values during an upgrade, the new bot signatures will not automatically overwrite your existing lists. To take full advantage of the updated AI/Bot detection, please manually copy and paste the new lists below into your add-on options:

1. Navigate to Admin CP > Setup > Options > Advanced Traffic Statistics.
2. Replace your existing lists with the ones below.
3. Save the changes.

Good Bots List:

Code:

Googlebot
Bing
Yahoo
DuckDuckGo
Yandex
Baidu
Sogou
Exabot
Applebot
Samsung
Huawei
Miui
Facebook
WhatsApp
Telegram
Twitter
Pinterest
Discord
LinkedIn
Skype
Viber
Snapchat
Slackbot
Mastodon
Cloudflare
Uptime
Pingdom
StatusCake
PayPal
Stripe
Google-Read-Aloud
AdsBot-Google
Google-Site-Verification
AppleNewsBot

AI / Scraper Bots List:

Code:

GPTBot
ChatGPT
ChatGPT-User
OAI-SearchBot
Claude
ClaudeBot
Anthropic
CommonCrawl
CCBot
Bytespider
Diffbot
Imagesift
Perplexity
YouBot
Omgili
Google-Extended
GoogleOther
Applebot-Extended
Amazonbot
FacebookBot
meta-externalagent
meta-externalfetch
cohere-ai
magpie-crawler

Bad / Junk Bots List:

Code:

AhrefsBot
SemrushBot
MJ12bot
DotBot
PetalBot
MegaIndex
BLEXBot
DataForSeoBot
SerpstatBot
ZoominfoBot
Ubervac
Barkrowler
Buck
SMTBot
TraceMyFile
LinkpadBot
ExtLinksBot
ltx71
NetSystemsResearch
Shodan
CensysInspect
python-requests
curl/
Wget/
libwww-perl
Go-http-client
Java/
Scrapy
GuzzleHttp
okhttp
aiohttp
PostmanRuntime
sqlmap
Nikto
Havij
Netsparker
OpenVAS
Nmap
Nuclei
Zgrab
DirBuster
Hydra
Masscan
w3af
IbouBot
trendictionbot
VelenPublicWebCrawler
BitSightBot
HeadlessChrome
BurpSuite

Anti-Spoofing: Verified Bot Map:

Code:

Googlebot : .googlebot.com, .google.com
bingbot : .search.msn.com, .microsoft.com
Yahoo : .crawl.yahoo.net
Yandex : .yandex.com, .yandex.ru, .yandex.net
Baidu : .baidu.com, .baidu.jp
DuckDuckGo : .duckduckgo.com, .search.msn.com, .microsoft.com
DuckDuckBot : .duckduckgo.com, .search.msn.com, .microsoft.com
Applebot : .apple.com, .apple-dns.net
Amazon : .amazon.com, .amazonaws.com
Twitter : .twitter.com, .twttr.com
Pinterest : .pinterest.com
LinkedIn : .linkedin.com
PetalBot : .aspiegel.com, .petalsearch.com, .hwclouds-dns.com
GPTBot : .openai.com
ChatGPT-User : .openai.com
OAI-SearchBot : .openai.com
ClaudeBot : .anthropic.com
Bytespider : .bytedance.com

FIXES & IMPROVEMENTS

• Improved GeoIP handling (TOR Network):
  • Fixed a bug where visitors originating from the TOR network (via Cloudflare's "T1" code) would display a broken image instead of a flag.
  • These connections are now correctly mapped to the default "Unknown" icon to maintain a clean UI.
• Database Compatibility (MySQL Fix):
  • Fixed a critical installation error (MySQL query error 3988) that occurred on servers with older database collations.
  • Replaced special graphical characters (█) in the phrase system with standard compatible characters (#) to ensure a smooth installation and upgrade process for all users.
• Versioning:
  • Add-on core updated to version 1.8.3.

NEW KEY FEATURES

AI Security Analyst (AI Radar)

Automated Daily Reports: Every night at 12:30 AM (UTC), the add-on collects the day's traffic data (humans, legitimate bots, blocked threats) and securely sends it to the AI (based on Google Gemini 2.5 Flash).

Advanced Forensic Analysis: The AI doesn't simply summarize the numbers; it thoroughly examines a sample of the last 200 connections to uncover suspicious patterns, aggressive scraping bots (e.g., HeadlessChrome), unauthorized AI training attempts (e.g., ChatGPT bots), and spoofed user agents.

Intelligent Monthly Log: The AI automatically publishes the report in a private staff room of your choice. The system is intelligent: it creates a single thread for each month (e.g., "Security Log - 03/2026") and appends the daily reports as replies, keeping the forum clean and tidy.

Note: This feature is disabled by default and can be configured using the new options in the admin panel (requires a free Google AI Studio API key). (PRO feature)

NOTE: AI prompts and generated thread titles are managed through XenForo's native Phrase system. This allows the report to be instantly translated into any language simply by editing the phrase from the Admin panel (the AI will automatically respond in the requested language).

"Hard Drop" Anti-DDoS and Anti-Scraping System

A new active security mechanism has been introduced. Connections classified as serious threats are no longer simply ignored or logged; they are now "hard dropped" at the server level. This significantly reduces database load and protects the forum from resource overload. (New feature available in options)

Query Optimization: Improved daily traffic extraction queries to support high-traffic forums without impacting Cron load times.

Fixed a minor bug that caused incorrect text to appear in the 7-day chart in the widget and in the Pro user-only stats

Hello everyone!We are incredibly proud to announce the release of Advanced Traffic Statistics 1.8.1, nicknamed "The Hunter".

This update focuses heavily on real-time threat unmasking, database performance for Large Boards, and giving you more control over your Live Radar.

What's New in 1.8.1:

• [Added] Smart Signature Extractor: The Live Radar now features a dynamic algorithm that unmasks advanced bots and scrapers (such as HeadlessChrome or AI crawlers) hiding behind fake browser data. "Unknown Bots" are now a thing of the past!
• [Added] Interactive Radar Filters: We've introduced a new dropdown menu right above the Live Radar. You can now filter real-time traffic on the fly (Humans Only, Bots Only, Blocked, or Spoofed) and adjust the display limit (up to 500 rows to ensure optimal server performance).
• [Optimized] 504 Timeout Fix for Large Boards: The default IP log retention has been safely reduced from 30 to 7 days. This drastically cuts down database bloat, resulting in lightning-fast dashboard loading times and entirely preventing 504 Server Timeouts on high-traffic forums.
• [Fixed] Chart Accuracy: Spoofed bots (fake Googlebots, etc.) are now instantly stripped of their disguises and correctly excluded from the "Good Bots" charts.
• [Fixed] CSV Export: The CSV export tool has been completely rewritten to perfectly match the new Smart Radar logic and formatting.

The "Hunter" Community Challenge!Now that the Radar is smarter than ever, we want to see it in action!Install the 1.8.1 update, let it run, and share a screenshot of your Live Radar catching a sneaky bot or a blocked threat in the discussion thread. Let's see who catches the worst offender!

Thank you all for your continuous feedback and support. Update now and secure your board!

This major update focuses heavily on Privacy (GDPR compliance), system stability, and giving you more control over your data. We highly recommend all users upgrade to this version.

What's New in 1.8.0:

• [Privacy & GDPR] 100% Local Assets (No CDN): We have moved all external resources locally! The Interactive Map libraries (ECharts) and all country flag icons (SVGs) are now hosted directly on your server. The add-on makes zero external CDN requests, guaranteeing absolute privacy for your visitors and making your dashboard load instantly even if external networks go down.
• [Fix & Stability] Strict UTF-8 DB Enforcement: Fixed a critical MySQL query error [1366] caused by aggressive bots (e.g., Baidu) injecting malformed or non-UTF-8 characters into the User-Agent strings. The traffic logger now strictly sanitizes and enforces UTF-8 encoding on all incoming data before it hits your database, preventing query crashes.
• [Fix] Map Visibility Bug: Fixed a logic issue where the interactive map was not displaying for registered members and guests even when the correct viewing permissions were enabled.

Important Upgrade Note: Because we have added new local image and script directories, please make sure you upload the entire contents of the new styles/statistiche folder to your server to ensure the map and flags display correctly.