IPFlow for WHMCS

Automated Blacklist (DNSBL) & Cron Setup

This guide explains how IPFlow automatically automates IP reclamation using the WHMCS Daily Cron, monitors real-time blacklist reputation (DNSBL/RBL), quarantines dirty IPs, and alerts you when pools run low.

Automated IP Cleanup with WHMCS Daily Cron

IPFlow hooks directly into your native WHMCS Daily Cron Job. You do not need to configure any separate crontab entries!

graph TD
    Cron["WHMCS Daily Cron Job Runs"] --> Reconcile["IPFlow Automated Daily Reconciliation"]
    Reconcile --> Task1["1. Orphaned IP Reclamation (Reclaims IPs from Terminated/Cancelled Accounts)"]
    Reconcile --> Task2["2. Automated Blacklist (DNSBL) Fleet Sweep"]
    Reconcile --> Task3["3. Pool Capacity Alert Checks (80% Amber / 95% Red)"]

What Happens During the Daily Cron Sweep:

  1. Orphaned IP Reclamation:
  2. IPFlow scans all assigned IP addresses against WHMCS hosting records (tblhosting).
  3. If a customer account has been marked Terminated, Cancelled, or has been deleted by an admin, IPFlow automatically frees the IP and returns it to your available pool.
  4. Automated Audit Logging:
  5. Every automatic reclamation is logged with the service ID, client ID, and timestamp so you have a complete audit history.

[!TIP]
You can also run the reconciliation manually at any time by clicking the Reconcile Now button on the IPFlow Dashboard.

Real-Time Blacklist (DNSBL / RBL) Reputation Engine

IPFlow actively protects your network reputation by checking your IP fleet against leading email and security blacklists:

+-------------------------------------------------------------------------------+
|                      Integrated Blacklist Providers                           |
+-------------------------------------------------------------------------------+
| [ Spamhaus ZEN ]     : World's leading spam and malware IP blocklist.         |
| [ SpamCop ]          : Real-time spam trap and abusive network monitoring.    |
| [ Barracuda Central ]: Global reputation network tracking malicious sending.  |
+-------------------------------------------------------------------------------+

How to Run a Blacklist Check:

  • Single IP On-Demand Check: In the IP Addresses table, click the Check Blacklist icon next to any IP address. IPFlow will query all three providers and display an instant popup report showing whether the IP is clean or listed.
  • Bulk Fleet Check: Select multiple checkboxes in your IP inventory table, choose Check Blacklist from the floating bottom toolbar, and scan entire subnets at once.
  • Automated Background Cron Sweep: During the daily cron, IPFlow systematically sweeps un-checked IPs to keep your reputation metrics fresh.

How Automated Quarantine Works

If a free IP address in your pool is detected on an RBL/DNSBL blacklist, IPFlow takes immediate protective action:

+-------------------------------------------------------------------------------+
| [ DETECTED ON SPAMHAUS ]                                                      |
|         │                                                                     |
|         ▼                                                                     |
| Status Mutated:  [ Free ]  ──►  [ RESERVED (Quarantined) ]                    |
| Reason Recorded: "Automated RBL Quarantine: Listed on Spamhaus ZEN"           |
| Action:          IP is instantly locked so NO NEW CUSTOMER can receive it!    |
+-------------------------------------------------------------------------------+
  1. Automatic Isolation: The dirty IP is immediately moved from Free to Reserved status.
  2. Order Protection: Because the IP is reserved, WHMCS will never assign it to a new customer, preventing client complaints and refund requests.
  3. Admin Alert: An alert is recorded in the WHMCS Activity Log so your network team can investigate the abuse or request delisting from Spamhaus/SpamCop.
  4. Delisting Recovery: Once delisted, simply click Unreserve to return the clean IP to your active pool.

Capacity Warning & Critical Thresholds

IPFlow continuously tracks your pool utilization to ensure you never run out of IP addresses unexpectedly:

+-------------------------------------------------------------------------------+
| Subnet Pool: Frankfurt KVM Pool #1 (185.190.20.0/24)                          |
| Utilization: [████████████████████░░░░░] 84% (41 Free IPs Remaining)          |
| Status     : [ AMBER WARNING: Pool capacity has exceeded 80% threshold ]     |
+-------------------------------------------------------------------------------+

Configurable Threshold Levels:

  • Amber Warning Alert (Default: 80%): When pool usage reaches 80%, an amber warning banner appears on your dashboard, and an activity log entry is generated.
  • Critical Red Alert (Default: 95%): When usage reaches 95%, critical priority banners warn administrators that the pool is near complete depletion.

You can customize these percentage thresholds at any time under System Settings > Addon Modules > IPFlow > Configure.