Loading
SikkerGuard is powered by SikkerAPI — threat intelligence from honeypot sensors and contributor reports. Optionally connect your own AbuseIPDB key, enable blocklist.de feeds, or add a custom blacklist. Everything is merged, deduplicated, and applied to your iptables firewall automatically.
| Time | IP Address | Action | Proto | Pkts | Source |
|---|---|---|---|---|---|
| 14:23:07 | 185.220.101.34 | BLOCKED | ssh | 12 | SikkerAPI |
| 14:23:03 | 80.94.92.168 | BLOCKED | ssh | 5 | AbuseIPDB |
| 14:22:50 | 45.148.10.240 | BLOCKED | http | 3 | blocklist.de |
| 14:22:38 | 193.42.33.105 | BLOCKED | smtp | 1 | SikkerAPI |
| 14:22:26 | 92.63.197.22 | BLOCKED | ssh | 28 | SikkerAPI |
SikkerGuard is powered by SikkerAPI — our own threat intelligence platform built on honeypot sensors and contributor reports. You can extend coverage further by connecting third-party integrations with your own accounts. Here's what each source provides.
SikkerAPI is the threat intelligence platform behind SikkerGuard. It combines data from two sources: a global network of honeypot sensors simulating 17 vulnerable protocols (SSH, HTTP, MySQL, PostgreSQL, FTP, SMTP, Redis, MongoDB, Docker, SMB, Telnet, and more), and contributor reports from the SikkerAPI community — including other SikkerGuard users who opt in to the feedback loop.
Every IP that interacts with a honeypot is definitively suspicious — there are no legitimate users on a honeypot. Combined with real-world contributor reports, this produces high-confidence threat data. Each IP receives a confidence score (1–100) based on attack frequency, protocol diversity, and behavioral patterns. SikkerGuard pulls IPs above your configured score threshold.
AbuseIPDB is a community-driven database where server administrators report abusive IPs. Add your own AbuseIPDB API key in the SikkerGuard dashboard, set a confidence threshold (default 90%), and SikkerGuard pulls the highest-reported offenders into your blocklist automatically.
blocklist.de collects attack reports from thousands of servers and publishes categorized feeds. Enable this integration from the Sources page and choose the feeds relevant to your server: SSH brute force, mail abuse, web attacks, FTP, SIP/VoIP, persistent attackers, and more.
SikkerGuard doesn't just consume threat intelligence — it contributes back. When your firewall blocks a connection, SikkerGuard reports the IP, protocol, and packet count to SikkerAPI. This data updates confidence scores and timing for all users. The more servers running SikkerGuard, the better the intelligence gets.
Honeypot sensors capture attacker behavior. IPs scored by confidence. Shared via API.
Blocks threats at iptables. Reports blocked IPs back. Strengthens the network.
Contributor reporting is optional. Disable it from settings if you prefer not to share data.
Applying external blocklists to a production firewall is risky if done wrong. SikkerGuard was built with multiple safety layers to ensure it never breaks your server.
One docker-compose file. One API key. Your server starts blocking known threats immediately. Configure sources, integrations, and thresholds from the web dashboard at port 7064.
Need a SikkerAPI key? Free plan includes 1,000 daily lookups. No credit card required.
Full install guide →SikkerGuard is powered by SikkerAPI — threat intelligence from honeypot sensors and contributor reports. You can optionally extend coverage by connecting your own AbuseIPDB API key, enabling blocklist.de feeds, or adding a custom IP/CIDR blacklist. All sources are merged and deduplicated before applying to iptables.
Honeypot sensors run fake services with no legitimate users. Every IP that connects is definitively suspicious. Community reports (like AbuseIPDB) rely on manual reporting and can include false positives. SikkerAPI combines honeypot sensor data with contributor reports for its core intelligence. You can layer on AbuseIPDB as a supplementary feed with configurable confidence thresholds.
Yes. Add your own AbuseIPDB API key in the SikkerGuard dashboard, set a minimum confidence score, and IPs are pulled and merged into your iptables blocklist automatically. No bash scripts, no cron jobs. blocklist.de works the same way but doesn't require an API key — just enable the feeds you want from the Sources page.
When SikkerGuard blocks a connection, it optionally reports the IP, protocol, and packet count back to SikkerAPI. This updates threat confidence scores and timing, improving the intelligence for all users. You can disable contributor reporting from settings.
Start blocking known threats today. Deploy SikkerGuard and let real threat intelligence protect your server.
Install now →