> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Use Curated Blocklists in Tenant Access Control Lists

> Use Auth0-managed curated IP blocklists in Tenant ACL rules to automatically block known threats without manually maintaining IP ranges or ASNs.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  This feature is available for **Attack Protection** customers.
</Callout>

Auth0 curates blocklists for several threat intelligence categories, like low reputation IPs and TOR exit nodes, which you can reference in your [Tenant Access Control List (ACL)](/docs/secure/tenant-access-control-list) rules. When traffic matches any entry in an enabled curated blocklist, Auth0 automatically executes the action defined in your ACL rule, such as blocking the request.

You can use our dynamically updated blocklists instead of manually maintaining IP ranges or Autonomous System Numbers (ASNs), or combine our blocklists with other CIDR blocks, ASNs, or geolocation matchers.

## Key capabilities

* **Automated updates**: Auth0 Threat Intelligence continuously updates all `auth0.*` blocklist feeds, requiring no manual rule updates on your end.
* **Unified matching**: The `auth0_managed` matcher handles underlying complexity, such as mixing IPv4, IPv6, and TLS fingerprints, transparently within a single array.

## Available curated blocklists

Auth0 organizes curated blocklists into broad categories using standard naming conventions. All curated blocklists use the `auth0.<category>` prefix:

| Blocklist identifier       | Category            | Description                                                                                                               |
| -------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `auth0.low_reputation`     | Low Reputation IPs  | High-risk IP addresses identified by Auth0 threat intelligence, such as active threat vectors or high-risk origin points. |
| `auth0.icloud_relay_proxy` | Apple Private Relay | Traffic originating from Apple iCloud Private Relay egress nodes.                                                         |

## Configure rules with curated blocklists

Configure curated blocklists using the `auth0_managed` matcher in the [Network ACLs Management API](/docs/api/management/v2) inside a rule definition.

### Block traffic from curated blocklists

To block traffic from low-reputation IPs at the authentication endpoint, send a `POST` request to `/api/v2/network-acls`:

```json theme={null}
{
  "description": "Block low-reputation IPs",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation"
      ]
    },
    "scope": "authentication"
  }
}
```

### Combine with other matchers

You can combine curated blocklists with CIDR blocks, ASNs, or geolocation matchers in the same ACL rule:

```json theme={null}
{
  "description": "Block specific regions and curated threat IPs",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "auth0_managed": [
        "auth0.low_reputation",
        "auth0.icloud_relay_proxy"
      ],
      "geo_country_codes": [
        "CN"
      ]
    },
    "scope": "authentication"
  }
}
```

### Exclude curated blocklist traffic

Use `not_match` to explicitly allow traffic that is not on a curated blocklist. For example, you can allow traffic not flagged as low reputation while a broader blocking rule is in effect:

```json theme={null}
{
  "description": "Allow traffic not flagged as low reputation",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "allow": true
    },
    "not_match": {
      "auth0_managed": ["auth0.low_reputation"]
    },
    "scope": "authentication"
  }
}
```

## Learn more

* [Configure Tenant Access Control List Rules](/docs/secure/tenant-access-control-list/configure-rules)
* [Rule Evaluation](/docs/secure/tenant-access-control-list/rule-evaluation)
* [Management API Parameter Reference](/docs/secure/tenant-access-control-list/reference)