Use Curated Blocklists in Tenant Access Control Lists

This feature is available for Attack Protection customers.

Auth0 curates blocklists for several threat intelligence categories, like low reputation IPs and TOR exit nodes, which you can reference in your Tenant Access Control List (ACL) rules. When traffic matches any entry in an enabled curated blocklist, Auth0 automatically executes the action defined in your ACL rule, such as blocking the request. You can use our dynamically updated blocklists instead of manually maintaining IP ranges or Autonomous System Numbers (ASNs), or combine our blocklists with other CIDR blocks, ASNs, or geolocation matchers.

Key capabilities

Automated updates: Auth0 Threat Intelligence continuously updates all auth0.* blocklist feeds, requiring no manual rule updates on your end.
Unified matching: The auth0_managed matcher handles underlying complexity, such as mixing IPv4, IPv6, and TLS fingerprints, transparently within a single array.

Available curated blocklists

Auth0 organizes curated blocklists into broad categories using standard naming conventions. All curated blocklists use the auth0.<category> prefix:

Blocklist identifier	Category	Description
`auth0.low_reputation`	Low Reputation IPs	High-risk IP addresses identified by Auth0 threat intelligence, such as active threat vectors or high-risk origin points.
`auth0.icloud_relay_proxy`	Apple Private Relay	Traffic originating from Apple iCloud Private Relay egress nodes.

Configure rules with curated blocklists

Configure curated blocklists using the auth0_managed matcher in the Network ACLs Management API inside a rule definition.

Block traffic from curated blocklists

To block traffic from low-reputation IPs at the authentication endpoint, send a POST request to /api/v2/network-acls:

{
  "description": "Block low-reputation IPs",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation"
      ]
    },
    "scope": "authentication"
  }
}

Combine with other matchers

You can combine curated blocklists with CIDR blocks, ASNs, or geolocation matchers in the same ACL rule:

{
  "description": "Block specific regions and curated threat IPs",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation",
        "auth0.icloud_relay_proxy"
      ],
      "geo_country_codes": [
        "CN"
      ]
    },
    "scope": "authentication"
  }
}

Exclude curated blocklist traffic

Use not_match to explicitly allow traffic that is not on a curated blocklist. For example, you can allow traffic not flagged as low reputation while a broader blocking rule is in effect:

{
  "description": "Allow traffic not flagged as low reputation",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "allow": true
    },
    "not_match": {
      "auth0_managed": ["auth0.low_reputation"]
    },
    "scope": "authentication"
  }
}

Protect Your Application

Call APIs On User's Behalf

Protect Your Tenant

Compliance

Use Curated Blocklists in Tenant Access Control Lists

Key capabilities

Available curated blocklists

Configure rules with curated blocklists

Block traffic from curated blocklists

Combine with other matchers

Exclude curated blocklist traffic

Learn more

​Key capabilities

​Available curated blocklists

​Configure rules with curated blocklists

​Block traffic from curated blocklists

​Combine with other matchers

​Exclude curated blocklist traffic

​Learn more

Key capabilities

Available curated blocklists

Configure rules with curated blocklists

Block traffic from curated blocklists

Combine with other matchers

Exclude curated blocklist traffic

Learn more