IP, Username, and Email Alerts

We already had CIDR range alerts for monitoring network blocks. You define a CIDR range, and when IPs in that range appear in our threat data, you get a digest email. That works well for watching a /24 or a /16, but not everything is a network range. Sometimes you want to watch a single IP, a service account name, or an email address.

So we added three new alert types to the dashboard:

• IP Alerts — your IP addresses, watched against our sensor data and community reports
• Username Alerts — usernames watched against brute-force attacks on our sensors
• Email Alerts — email addresses watched against SMTP traffic on our sensors

Each one works independently. Set up what you need, ignore what you don't.

IP Alerts

You add an IP address. When that IP shows up on our honeypot sensors or in community reports, you get an email.

The use case is defensive: you're watching your own infrastructure. If you run a homelab, a VPS, a mail server, a small business network, add your public IPs. If one of them starts appearing in our attack data, something on your end is compromised and attacking outward. You want to know that before your hosting provider sends you an abuse notice.

IP alerts match against two sources: direct observations on our honeypot sensors and community reports submitted by other users (via Fail2Ban, CSF, SikkerGuard, or manual submission). The digest email tells you which IP was seen, when, and whether it was observed on our sensors, reported by the community, or both.

Dashboard: https://dashboard.sikkerapi.com/ip-alerts

Username Alerts

You add a username. When that username appears in authentication attempts on our sensors (SSH, FTP, Telnet, MySQL, any protocol), you get an email.

If you run services with named accounts (deploy, monitoring, backup, your employees' names), you can add them here. Our username database already tracks 77,000+ usernames from real attacks. Username alerts let you set up ongoing monitoring for the specific ones you care about.

The digest email includes the username, the protocol it was seen on, how many times, and when.

Dashboard: https://dashboard.sikkerapi.com/username-alerts

Email Alerts

You add an email address. When that address appears in SMTP data on our sensors (as a sender, recipient, or anywhere in the message envelope), you get notified.

Our SMTP honeypots capture live phishing and spam campaigns. The email threat check page already lets you search 110,000+ targeted addresses. Email alerts are the automated version: instead of checking manually, you'll get notified when new activity hits.

The digest email includes the email address, how many times it appeared, and when.

Dashboard: https://dashboard.sikkerapi.com/email-alerts

How Notifications Work

All three alert types use hourly digests, same as range alerts. When a match is detected, it's queued. Once per hour, any pending matches are bundled into a single email per alert type. You won't get spammed with individual notifications.

Each alert has two independent toggles in the dashboard:

• Enabled controls whether the alert is actively monitoring
• Email notifications controls whether matches trigger a digest email

You can leave an alert enabled but turn off email notifications if you just want to track match counts in the dashboard without inbox noise.

Plan Limits

All three alert types are included on the free plan. No credit card, no paid subscription required. The number of alerts you can create depends on your tier, but free accounts can start using all three immediately.

The dashboard shows your current usage and limits. Each alert type has its own limit. IP alerts, username alerts, and email alerts are counted separately. Higher plans allow more alerts per type.

Setting Up

1. Log into the https://dashboard.sikkerapi.com
2. Navigate to IP Alerts, Username Alerts, or Email Alerts in the sidebar
3. Click Add and enter the value you want to monitor
4. Optionally add a label to keep things organized
5. Done. You'll get a digest email when there's a match

Labels are for your own reference. If you're monitoring multiple IPs, tagging them as "Web Server", "Mail Server", "Home" makes the digest emails easier to scan.