How often are range alert emails sent?

Digest emails are sent once per hour. New matches are queued and grouped together, so you won't receive individual notifications for each IP. If nothing new is detected, no email is sent.

CIDR Range Alerts

Q: What are CIDR range alerts?

CIDR range alerts let you monitor IP address ranges for threat activity. When an IP in your defined range is detected by SikkerAPI honeypot sensors or reported by the community, you get an email notification with the IP details.

Q: Are range alerts available on the free plan?

Yes. Range alerts are included on every SikkerAPI plan, including the free tier. Higher tiers allow more ranges and broader CIDR prefixes.

Get notified when malicious IPs show up in your network ranges.

Step-by-step guide · Back to Docs

Overview

What Are Range Alerts?

Range alerts let you define CIDR blocks you want to keep an eye on. When an IP in one of your ranges gets picked up by our honeypot sensors or flagged through a community report, we send you a digest email with the details.

Each email includes the IP, confidence score, country, and when it was last seen. You can click through to the full report on sikkerapi.com or look it up programmatically with the IP Check API.

Range alerts are available on every plan, including the free tier. Higher tiers allow more ranges and broader CIDR prefixes.

Step 1

Open Range Alerts

SikkerAPI dashboard sidebar showing the Range Alerts navigation item highlighted — Click Range Alerts in the sidebar to get started

Step 2

Review Your Limits

The range alerts page shows how many ranges you're using and what your plan allows. It also shows the minimum prefix length, which determines how large of a network block you can monitor.

A smaller prefix number means a larger network block. For example, a /24 covers 256 addresses while a /16 covers 65,536.

Range alerts page showing plan usage: 0 of 40 ranges used on a Large Business plan with minimum prefix /16 — Plan limits are shown at the top of the page — this example shows a Large Business plan with 40 ranges and /16 minimum prefix

Step 3

Create a Range Alert

Click Add Range and enter a CIDR block (e.g. 162.142.125.0/24). You can also add a label to help you tell your ranges apart later.

The CIDR is validated and normalized automatically. Your prefix can't be broader than what your plan allows — for example, if your minimum is /24, you can't add a /16.

Add range alert form with empty CIDR range and label fields — Enter your CIDR range and an optional label

Add range alert form filled with CIDR 162.142.125.0/24 and label Range Name — Example: monitoring 162.142.125.0/24 with a descriptive label

Step 4

Manage Your Ranges

Once created, your range shows up in the table. You can toggle it on or off, and separately control whether you get email notifications. The activity columns show how many unique IPs matched and total hits.

•Enabled toggle — pause or resume monitoring without deleting the range
•Email toggle — turn email notifications on or off for this range
•Activity — shows unique IPs matched and total hit count
•Last Alert — when the most recent digest was sent for this range

Range alerts table showing a monitored CIDR range with enabled and email toggles, activity counters, and delete action — A range with monitoring and email notifications enabled

Step 5

Receive Email Alerts

When an IP in one of your monitored ranges gets flagged — either by our honeypot sensors or through a community report — it gets queued for your next digest email. Digests are sent once per hour, so you won't get spammed with individual notifications. If nothing new is detected, no email is sent. Each digest groups the new IPs by range and includes:

•IP address — linked to the full report on sikkerapi.com
•Confidence score — how certain SikkerAPI is that the IP is malicious (0–100)
•Country — where the IP is located
•Last seen — when the IP was last seen on our network

You'll only get notified about an IP once per range. If the same IP shows up again, the match count goes up but you won't get another email about it.

Range alert email digest showing 2 detected threat IPs with confidence scores, countries, and last seen timestamps — A digest email showing two flagged IPs with confidence scores and last seen timestamps

Availability

Plans & Limits

Range alerts are included on every plan. Higher tiers let you monitor more ranges and use broader prefixes.

Check your current limits on the range alerts dashboard or see the pricing page for a full comparison.

Want to check IPs programmatically? The IP Check API returns confidence scores, protocols, behaviors, geolocation, and more for any IP address.

FAQ

Frequently Asked Questions

What are CIDR range alerts?

They let you monitor IP address ranges for threat activity. When an IP in your defined range is detected by our honeypot sensors or reported by the community, you get an email with the details.

How often are emails sent?

Digest emails go out once per hour. New matches are queued and grouped together so you don't get bombarded with individual notifications. If nothing new comes up, no email is sent.

Are range alerts available on the free plan?

Yes. Range alerts are included on every plan, including the free tier. Higher tiers let you monitor more ranges and use broader CIDR prefixes.

Will I get duplicate emails for the same IP?

No. Each IP is only included in a digest once per range. If the same IP shows up again, the match count goes up but you won't get another email about it.