Show HN: Zahosts Health – An open-source WHM plugin to catch /24 brute-force

Description and use

**Brief Summary (2‑3 sentences)**
Zahosts Health is an open‑source WHM (WebHost Manager) plugin that monitors login activity to detect /24‑range brute‑force attacks on cPanel accounts. By aggregating failed‑login attempts across an entire /24 subnet, it can flag coordinated attacks that would otherwise slip past per‑IP rate limits, helping hosting providers harden their infrastructure.

**Value**

• **Targeted security**: Detects distributed credential‑spraying attacks that spread across many IPs within the same /24 network, a pattern common with botnets and compromised residential gateways.
• **Low‑cost hardening**: As a free plugin, it adds an extra layer of intrusion detection without requiring a separate SIEM or third‑party service.
• **Actionable alerts**: Generates WHM‑compatible notifications (email, cPanel alerts) that can trigger automated blocks or manual review.

**Practical Adoption Path**

1. **Review repository** – Clone the project, verify the license (e.g., MIT/Apache), and read the README for installation steps and configuration options.
2. **Test in a sandbox** – Deploy the plugin on a non‑production WHM instance, enable the default monitoring profile, and generate synthetic failed‑login traffic to confirm detection and alerting.
3. **Integrate with existing controls** – Map the plugin’s alerts to your firewall or fail2ban rules, or to a ticketing system for incident response.
4. **Configure thresholds** – Adjust the number of failures and time windows that constitute a /24 brute‑force event, based on your traffic baseline.
5. **Roll out gradually** – Enable the plugin on a subset of servers or accounts, monitor false‑positive rates, and refine the settings before full deployment.

**Production Readiness**

• **Maturity**: Updated recently (2026‑06‑23) but with limited activity (only two topics) and sparse documentation, placing it at a **medium** readiness level.
• **Dependencies**: Relies on WHM/cPanel APIs; ensure compatibility with your WHM version and any custom plugins.
• **Maintenance**: No clear release cadence or active issue triage, so you’ll need to monitor the repo for security patches or consider forking for long‑term support.
• **Risk mitigation**: Conduct a security audit of the code, verify that the plugin does not expose additional attack surfaces, and implement fallback mechanisms (e.g., manual lockouts) in case the plugin fails.

Overall, Zahosts Health can be a valuable addition for hosting environments that need to detect distributed brute‑force attempts, provided you perform the necessary due‑diligence, pilot testing, and integration work before treating it as a production‑critical component.

Use in a workflow

Show HN: Zahosts Health – An open-source WHM plugin to catch /24 brute-force may be useful when its README and activity match a concrete workflow.

Limitations and review notes

Medium: useful for prototypes or internal workflows, with dependency and maintenance checks before production.