Hey Brian! The “sales” you see here isn’t specific to a domain because this was the “Brute Force by Email” rule which triggers on the account used. Because this hacker didn’t specify a domain, you’re seeing just the account. You can set up events for IDS blocks in Settings>Events and Settings>System Messages to notify on block as well. I hope that helps!