sikkerapi@prod ~$
Why SikkerAPI|
Sikker-CLISikkerGuard
Honeypot DatabaseEmail LookupUsername LookupDetection CatalogSubnet CalculatorEncoder / Decoder
Prices
|
Fail2BanCSF FirewallNginxiptables / ipset
|
Blog
OverviewIP CheckBlacklistReportBulk ReportTAXII FeedSikker-CLIConfidence Score Algorithm
Top CountriesTop ASNsTop ProtocolsTop IPsSMTP Database
CIDR Range AlertsIP AlertsUsername AlertsEmail AlertsBlacklist Web-UIInstall SikkerGuard
|login|signup
Loading
SikkerAPI

Open source threat intelligence from a global honeypot sensor network. Real attacker behavior, not purchased feeds.

Product
PricingDocumentationReport an IPThreat MapSystem Status
Resources
BlogFAQAboutContactComparisons
Tools
Sikker-CLISikkerGuardDetection CatalogSession DatabaseTAXII Feed
Browse
Top CountriesTop ASNsTop ProtocolsTop IPsSMTP Wall of Fame
© 2026 SikkerAPI
TermsPrivacyRemove Me
Home → Docs → Email Alerts

Email Alerts

Monitor specific email addresses for appearances in SMTP traffic captured by our global honeypot network. Get automated hourly digests when a watched email is detected.

Hourly digestsSMTP monitoringNo duplicate alerts2-minute setup
How It Works

From Email Address to Alert Digest

Add Email
Enter an email address to watch
Detection
SMTP honeypots capture the address
Match
Exact match against your watchlist
Digest
Hourly email with match details
Step 1

Add an Email Alert

Navigate to Email Alerts in your dashboard and click + Add Email. Enter any email address you want to monitor — for example, [email protected].

Add an optional label to identify the address (e.g. “Work Email”). Emails are normalized to lowercase automatically. Your plan determines how many addresses you can watch. See pricing for limits by tier.

dashboard.sikkerapi.com/email-alerts
Email Alerts
Using 0 of 10 email alerts (basic plan)
Add Email Alert
Email Address
[email protected]
Label (optional)
Work Email
CancelCreate Alert
Step 2

Manage & Monitor

Your alerts appear in a table with independent controls for each email address.

  • On/Off toggle — pause monitoring without deleting
  • Notify toggle — control digest emails per address
  • Match counter — times the email appeared in SMTP data
  • Click-to-edit labels — rename addresses inline
  • Last alert date — when the last digest was sent
dashboard.sikkerapi.com/email-alerts
Using 3 of 10 email alerts (basic plan)
Your Email Alerts+ Add Email
EmailLabelOnNotifyMatchesLast Alert
[email protected]Work Email23Mar 12Delete
[email protected]CI/CD Pipeline8Mar 13Delete
[email protected]Legacy0NeverDelete
Step 3

Receive Email Digests

When a watched email address appears as an SMTP recipient on our honeypot sensors, SikkerAPI queues a notification. Emails are batched into hourly digests — one email per hour at most.

Each entry shows the monitored address, how many times it appeared, and the most recent detection timestamp. This tells you exactly which of your addresses are being targeted by spammers or phishing campaigns.

  • Email — the monitored address that was detected
  • Count — how many times it appeared in SMTP traffic
  • Last seen — UTC timestamp of most recent detection
Email Alert
Your monitored e-mails were seen by SikkerAPI on our sensors.
EmailCountLast Seen
[email protected] (Work Email)23Mar 12, 14:32 UTC
[email protected] (CI/CD Pipeline)8Mar 12, 09:01 UTC
Manage alerts at dashboard.sikkerapi.com
Plans & Limits

Available on Every Plan

Email alerts are included for all users. Higher tiers unlock more monitored addresses.

PlanPriceMax Email Alerts
Free$0/mo5
Basic$7/mo10
Small Business$14/mo20
Medium Business$28/mo40
Large Business$56/mo80
IP Alerts
Monitor specific IPv4 addresses for threat activity. Track individual hosts, servers, or known threat actors across all protocols.
Username Alerts
Monitor specific usernames for credential attacks. Track brute-force campaigns with per-protocol breakdowns across SSH, FTP, MySQL, and more.

Frequently Asked Questions

What are email alerts?
Email alerts let you monitor specific email addresses for appearances in SMTP traffic. When a watched address is captured by our honeypot network as an SMTP recipient, you receive an hourly email digest with the address, match count, and the last-seen timestamp.
What triggers an email alert?
An alert triggers when the exact email address you're monitoring appears as a recipient in SMTP traffic captured by our honeypot sensors. This includes spam, phishing, and other unsolicited messages targeting that address.
Are email addresses case-sensitive?
No. Email addresses are normalized to lowercase when created. [email protected] and [email protected] are treated as the same address.
How are email alerts different from IP or username alerts?
IP alerts monitor IPv4 addresses across all protocols. Username alerts monitor credential strings across SSH, FTP, MySQL, and more. Email alerts focus specifically on SMTP recipient addresses — they tell you when your email addresses are being targeted by spam or phishing campaigns hitting our honeypots.
How often are digests sent?
Digests are batched hourly. Multiple detections of the same address within the same hour produce a single email showing the total count. You can disable notifications per address while keeping match tracking active.
Why would I monitor an email address?
Common use cases: checking if your organization's email addresses are being used as targets in spam or phishing campaigns, monitoring leaked addresses after a data breach, or tracking honeypot-specific trap addresses you've planted to detect abuse.
What happens if I downgrade my plan?
If your new plan has a lower limit, the newest alerts are automatically disabled (not deleted). Your data is preserved — upgrade again to re-enable them. See pricing for limits by tier.