Skip to content
Administration
Security and Blocking

Security and Blocking

Selling streams means defending them. XUI.live layers its protections: block unwanted networks, detect misuse of legitimate accounts, and harden the panel itself — each layer visible and adjustable, none of it an add-on.

Blocking

Four blocklists, each with its own screen and its own reach:

  • IPs — addresses and subnets, with a flush-all for the day a rule goes wrong.
  • ISPs — entire providers by name.
  • ASNs — whole networks by number, backed by a reference set of nearly 69,000 known networks, which is how hosting providers and VPN ranges are recognised.
  • User agents — players and scrapers by what they announce themselves as.

Two switches raise the bar globally: refuse connections from hosting-provider ranges — real viewers live on residential networks; restreamers rent servers — and from known proxies. Flood protection rate-limits abusive request patterns automatically, and per-line exceptions exist where you need them.

Catching misuse

The accounts most worth watching are the valid ones:

Restream detection watches for a line being redistributed. On detection the line is disabled automatically, the event is logged and a notification fires. Partners who legitimately redistribute get the restreamer flag on their line, so the protection never fights your wholesale side.

Line IP usage ranks lines by how many distinct IPs they connect from — over an hour, a day, a week, all time. The top of that list is your shared-password list.

VOD theft detection ranks lines by how many distinct titles they touch — a subscriber watches; a scraper harvests. The difference is unmistakable in the numbers.

Stream fingerprinting overlays an identifying mark on a chosen stream’s active sessions, tracing which subscription a leak is coming from. Use it deliberately: once started it cannot be cancelled, and it adds server load while it runs.

Hardening the panel

  • Two-factor authentication on panel accounts, with recovery codes — and a shell rescue for lost phones.
  • Brute-force limits on username and MAC attempts, with configurable thresholds.
  • reCAPTCHA on the login page.
  • Admin IP allow-list — the panel’s admin side answers only to addresses you trust.
  • Access codes — every entry path to the panel sits behind an unguessable path segment, restricted per group and optionally per IP.

Every layer writes to its own log — blocked attempts, restream detections, login failures — and the ones that matter can notify you the moment they fire.