DroneBL is a realtime blocklist of IPs involved in spam, proxies, botnets, DDoS drones, and brute-force attacks. This plugin wires it into cPanel/WHM with two independent protection layers, managed from a GUI in the WHM sidebar.
Mail protection rejects incoming mail from DroneBL-listed IPs at RCPT time using cPanel’s native Exim RBL mechanism — the same approach used by BarracudaRBL and SpamCop, so it survives cPanel updates cleanly.
Login protection runs a background worker every 5 minutes that watches cPHulk’s log for blocked IPs, checks each against DroneBL via DNS, and permanently blacklists any that match. An inode-tracked log offset ensures only new entries are processed each run, and a 7-day seen-IP cache avoids redundant lookups.
Both layers share a whitelist file at /etc/dronebl_whitelist.txt for IPs that should never be blocked. The whole thing ships as an RPM — install, visit WHM → Plugins → DroneBL Protection, and toggle what you need.
No DroneBL account required — it uses the public dnsbl.dronebl.org DNS service.