How often are range alert emails sent?

Digest emails are sent once per hour. New matches are queued and grouped together, so you won't receive individual notifications for each IP. If nothing new is detected, no email is sent.

Can I use range alerts with SikkerGuard?

Yes, they are complementary. SikkerGuard blocks threats at the firewall level in real time. Range alerts notify you when threats appear in specific ranges you care about.

Home → Docs → Range Alerts

CIDR Range Alerts

Q: What are CIDR range alerts?

CIDR range alerts let you monitor IP address ranges for threat activity. When an IP in your defined range is detected by SikkerAPI honeypot sensors or reported by the community, you get an email notification with the IP details.

Q: Are range alerts available on the free plan?

Yes. Range alerts are included on every SikkerAPI plan, including the free tier. Higher tiers allow more ranges and broader CIDR prefixes.

Q: Will I get duplicate emails for the same IP?

No. Each IP is only included in a digest once per range. If the same IP is seen again, the match count is updated but no new notification is sent.

Q: What CIDR notation should I use?

Standard IPv4 CIDR notation. /24 monitors 256 addresses, /16 monitors 65,536. The network address is normalized automatically.

Monitor your IP ranges for threat activity. Automated email digests when known attackers appear in your network blocks.

Hourly digestsAll plans includedNo duplicate alerts5-minute setup

How It Works

From CIDR Block to Email Alert

Add Range

Define a CIDR block to watch

Detection

Honeypots & community flag IPs

Match

Threat IP falls in your range

Digest

Hourly email with details

Step 1

Create a Range Alert

Enter any IPv4 CIDR block. The network address is normalized automatically — 192.168.1.50/24 becomes 192.168.1.0/24. Add an optional label to identify the range.

Your plan determines how many ranges you can create and the minimum prefix length. A smaller prefix = larger block: /24 covers 256 IPs, /16 covers 65,536.

dashboard.sikkerapi.com/range-alerts

Range Alerts

Using 0 of 5 ranges (basic)Min prefix: /24

Add Range Alert

CIDR Range

162.142.125.0/24

Minimum prefix: /24

Label (optional)

Censys Scanners

CancelCreate Alert

Step 2

Manage & Monitor

Created ranges appear in the alerts table with independent controls for each.

On/Off toggle — pause monitoring without deleting
Email toggle — control notifications per range
Activity counters — unique matches + total hits
Click-to-edit labels — rename ranges inline
Last alert date — when the last digest was sent

dashboard.sikkerapi.com/range-alerts

Using 3 of 5 ranges (basic)Min prefix: /24

Your Range Alerts+ Add Range

CIDR	Label	Activity	Last Alert
162.142.125.0/24	Censys Scanners	12 / 47 hits	Mar 12	Delete
185.220.101.0/24	Tor Exits	38 / 214 hits	Mar 13	Delete
10.0.0.0/24	Office	0 / 0 hits	Never	Delete

Step 3

Receive Email Digests

When threat IPs are detected in your ranges, they're queued for the next hourly digest. Each email includes:

IP address linked to full threat report
Confidence score (0–100)
Country geolocation
Last seen timestamp

Each IP appears once per range. Repeat detections update counters without triggering duplicate notifications. If nothing new is detected, no email is sent.

SikkerAPI <[email protected]>

Range Alert: 2 new threats in 162.142.125.0/24

Range Alert Digest

Censys Scanners — 162.142.125.0/24

IP Address	Confidence	Country	Last Seen
162.142.125.34	92	US	2 hours ago
162.142.125.213	67	US	5 hours ago

Manage alerts at dashboard.sikkerapi.com

Plans & Limits

Available on Every Plan

Range alerts are included for all users. Higher tiers unlock more ranges and broader CIDR prefixes.

Plan	Price	Max Ranges	Min Prefix
Free	$0/mo	1	/28
Basic	$7/mo	5	/24
Small Business	$14/mo	10	/20
Medium Business	$28/mo	20	/16
Large Business	$56/mo	40	/16

IP Check API

Look up any IP on demand. Returns confidence scores, protocols, behaviors, and geolocation. Pair with range alerts for full coverage.

SikkerGuard

Real-time firewall blocking powered by threat intelligence. Blocks known attackers at the kernel level with Docker.

Frequently Asked Questions

What are CIDR range alerts?

They let you monitor IP ranges for threat activity. When an IP in your range is detected by our honeypot sensors or reported by the community, you get a digest email. Learn more about our detection sources on the behind the scenes page.

How often are emails sent?

Once per hour. Matches are grouped into a single digest. If nothing new is detected, no email is sent.

Are range alerts available on the free plan?

Yes. Free tier includes 1 range with /28 minimum prefix. Upgrade for more ranges and broader prefixes.

Will I get duplicate emails for the same IP?

No. Each IP appears once per range. Repeat detections update the activity counter but don't trigger another notification.

Can I use this with SikkerGuard?

Yes. SikkerGuard blocks threats at the firewall in real time. Range alerts notify you about specific subnets. They complement each other.

What CIDR notation should I use?

Standard IPv4 CIDR. /24 = 256 IPs, /16 = 65,536 IPs. Network addresses are normalized automatically.

Home → Docs → Range Alerts

CIDR Range Alerts

Monitor your IP ranges for threat activity. Automated email digests when known attackers appear in your network blocks.

Hourly digestsAll plans includedNo duplicate alerts5-minute setup

How It Works

From CIDR Block to Email Alert

Add Range

Define a CIDR block to watch

Detection

Honeypots & community flag IPs

Match

Threat IP falls in your range

Digest

Hourly email with details

Step 1

Create a Range Alert

Enter any IPv4 CIDR block. The network address is normalized automatically — 192.168.1.50/24 becomes 192.168.1.0/24. Add an optional label to identify the range.

Your plan determines how many ranges you can create and the minimum prefix length. A smaller prefix = larger block: /24 covers 256 IPs, /16 covers 65,536.

dashboard.sikkerapi.com/range-alerts

Range Alerts

Using 0 of 5 ranges (basic)Min prefix: /24

Add Range Alert

CIDR Range

162.142.125.0/24

Minimum prefix: /24

Label (optional)

Censys Scanners

CancelCreate Alert

Step 2

Manage & Monitor

Created ranges appear in the alerts table with independent controls for each.

On/Off toggle — pause monitoring without deleting
Email toggle — control notifications per range
Activity counters — unique matches + total hits
Click-to-edit labels — rename ranges inline
Last alert date — when the last digest was sent

dashboard.sikkerapi.com/range-alerts

Using 3 of 5 ranges (basic)Min prefix: /24

Your Range Alerts+ Add Range

CIDR	Label	Activity	Last Alert
162.142.125.0/24	Censys Scanners	12 / 47 hits	Mar 12	Delete
185.220.101.0/24	Tor Exits	38 / 214 hits	Mar 13	Delete
10.0.0.0/24	Office	0 / 0 hits	Never	Delete

Step 3

Receive Email Digests

When threat IPs are detected in your ranges, they're queued for the next hourly digest. Each email includes:

IP address linked to full threat report
Confidence score (0–100)
Country geolocation
Last seen timestamp

Each IP appears once per range. Repeat detections update counters without triggering duplicate notifications. If nothing new is detected, no email is sent.

SikkerAPI <[email protected]>

Range Alert: 2 new threats in 162.142.125.0/24

Range Alert Digest

Censys Scanners — 162.142.125.0/24

IP Address	Confidence	Country	Last Seen
162.142.125.34	92	US	2 hours ago
162.142.125.213	67	US	5 hours ago

Manage alerts at dashboard.sikkerapi.com

Plans & Limits

Available on Every Plan

Range alerts are included for all users. Higher tiers unlock more ranges and broader CIDR prefixes.

Plan	Price	Max Ranges	Min Prefix
Free	$0/mo	1	/28
Basic	$7/mo	5	/24
Small Business	$14/mo	10	/20
Medium Business	$28/mo	20	/16
Large Business	$56/mo	40	/16

IP Check API

Look up any IP on demand. Returns confidence scores, protocols, behaviors, and geolocation. Pair with range alerts for full coverage.

SikkerGuard

Real-time firewall blocking powered by threat intelligence. Blocks known attackers at the kernel level with Docker.

Frequently Asked Questions

What are CIDR range alerts?

How often are emails sent?

Once per hour. Matches are grouped into a single digest. If nothing new is detected, no email is sent.

Are range alerts available on the free plan?

Yes. Free tier includes 1 range with /28 minimum prefix. Upgrade for more ranges and broader prefixes.

Will I get duplicate emails for the same IP?

No. Each IP appears once per range. Repeat detections update the activity counter but don't trigger another notification.

Can I use this with SikkerGuard?

Yes. SikkerGuard blocks threats at the firewall in real time. Range alerts notify you about specific subnets. They complement each other.

What CIDR notation should I use?

Standard IPv4 CIDR. /24 = 256 IPs, /16 = 65,536 IPs. Network addresses are normalized automatically.