With Blacklist Monitoring webhook notifications you can receive JSON data posted to your webhook url when changes are detected in your Blacklist Monitors.

Simply assign your webhook url to any of your Contact Lists, as show below:

 

(Please note that as of right now the “Send test notification” button will only send out an Uptime Monitoring webhook notification, you can read more about that webhook here. This means you cannot test Blacklist Monitoring webhooks using this feature.)

 

Once you’ve set your webhook url in your Contact List, whenever this Contact List is to be notified of changes in your Blacklist Monitors, it will post JSON formatted data to your webhook url. You can find such an example below (containing two items, ie: data from two monitors):

[
   {
      "monitor": "98.88.89.102",
      "lebel": "some label",
      "blacklisted_before": "7",
      "blacklisted_now": "6",
      "blacklisted_on": [
         {
            "rbl": "bl.nszones.com",
            "delist": "http://www.nszones.com/contact.shtml"
         },
         {
            "rbl": "bl.score.senderscore.com",
            "delist": "https://www.senderscore.org/blacklistlookup/"
         },
         {
            "rbl": "cidr.bl.mcafee.com",
            "delist": "https://kc.mcafee.com/corporate/index?page=content&id=KB53783"
         },
         {
            "rbl": "dyn.nszones.com",
            "delist": "http://db.nszones.com/dyn.ip?98.88.89.102"
         },
         {
            "rbl": "pbl.spamhaus.org",
            "delist": "https://www.spamhaus.org/query/ip/98.88.89.102"
         },
         {
            "rbl": "zen.spamhaus.org",
            "delist": "https://www.spamhaus.org/query/ip/98.88.89.102"
         }
      ],
      "links": {
         "report_link": "https://hetrixtools.com/report/blacklist/c855b5712bd63a3c8153690b56d5385e/",
         "whitelabel_report_link": "http://status.hetrixtools.com/report/blacklist/c855b5712bd63a3c8153690b56d5385e/"
      }
   },
   {
      "monitor": "190.129.206.24",
      "lebel": "another label",
      "blacklisted_before": "1",
      "blacklisted_now": "2",
      "blacklisted_on": [
         {
            "rbl": "dnsbl-2.uceprotect.net",
            "delist": "http://www.uceprotect.net/en/rblcheck.php?ipr=190.129.206.24"
         },
         {
            "rbl": "dnsbl-3.uceprotect.net",
            "delist": "http://www.uceprotect.net/en/rblcheck.php?ipr=190.129.206.24"
         }
      ],
      "links": {
         "report_link": "https://hetrixtools.com/report/blacklist/4255d1931a5c5547a0fce88e6cdff008/",
         "whitelabel_report_link": "http://status.hetrixtools.com/report/blacklist/4255d1931a5c5547a0fce88e6cdff008/"
      }
   }
]

 

Items in the JSON data will stack up to 100 times. If there are more than 100 changes detected at one time, our system will post multiple chunks of data, each containing a maximum of 100 items per chunk.

From our tests, we’ve determined that chunks can reach up to 512 KB of data, so make sure that your webhook script can handle such sizes, and will not timeout.

You should also make sure that your webhook script is prepared and “knows” how to handle multiple consecutive posts at once, for cases where our system has more than 100 items to notify you about and will have to send multiple chunks of data at once.

 

Please note that the webhook notifications will follow the contact list and account settings rules, for instance (but not limited to):
– Blacklist monitor change notification threshold
– Stack blacklist monitor notifications for X hours
– Do Not Disturb Schedule

This means that, unlike the Uptime Monitoring webhook notifications which trigger instantly, the Blacklist Monitoring webhook notifications will stack up and are sent out every X hours, as per your account settings (minimum setting every 1 hour).

 

Which IP will this data be posted from?

144.217.15.240

(useful if you’ll want to restrict access to your webhook script)

 

How to capture this data?

The webhook script should be quite simple. Here’s a PHP example on how you can capture the posted data from our system:

<?php
// Get the JSON data
$json = file_get_contents('php://input');
// Decode the JSON data into an array
$array = json_decode($json,true);
?>

Once you have captured the JSON data and converted it into an array, you can handle it and manage it however you wish.

 

What to expect when monitoring a big number of IPs/Domains?

If you’re monitoring tens/hundreds of thousands of IPs or Domains, you should design your webhook script to be able to handle cases where big blocks of IPs get delisted or blacklisted at once, which means there will be quite a lot of data being posted from our system to your webhook url, at the same time.

In such cases we’d recommend storing all the data locally in your environment and then process it separately via other scripts. This way the webhook script would only handle receiving the data and not processing it at the same time too. If your webhook script is handling both the data receiving and the data processing, when receiving a lot of chunks, it may take a long time to load and process that data, which may cause our system to timeout when posting some chunks of data. Please note that if timeouts are encountered by our system, the data post will not be retried again.