Blocklist proxies with high sign-in failure rates
Tor is open-source software used to enable anonymous communication and hide the location of end users. The software provides user anonymity, but it is often used by attackers to perform malicious activities. Okta enables admins to use Dynamic Zones to block IP addresses that are categorized as Tor anonymizer proxies (Tor exit nodes).
Create policies to block sign-in attempts from IPaddresses with high rates of failure. Okta provides admins with information about the IP address of each sign-in attempt, including proxy type.
Create a new Dynamic Zone for IPs that are categorized as Tor anonymizer proxies and block access. See Configure a Dynamic Zone to block anonymizer proxies.
When the failed sign-in rate decreases to below 50%, the HealthInsight recommendation moves from the Incomplete tab to the Complete tab. This might take a few days after you configure the blocklist settings.
Admins can run the following query in the System Log page, to view a list of all failed sign-in attempts that originated from IP addresses categorized as Tor anonymizer proxies.
eventType eq "user.session.start" and outcome.result eq "FAILURE" and debugContext.debugData.proxyType eq "tor"
Okta enables admins to use Dynamic Zones to block IPs that are categorized as Tor anonymizer proxies (Tor exit nodes).
- From the Admin Console, navigate to Security > Networks.
- Click Add Zone > Dynamic Zone to create a new Dynamic Zone.
- In Zone Name, enter a name for zone.
- To block the zone, select Block access from IPs matching conditions listed in this zone.
- In IP Type, select Tor anonymizer proxy.
- Click Save.
The accuracy of Tor proxy detection is dependent on a third party vendor, which is used to identify IP addresses that use Tor. The proxy type is only used to evaluate if a proxy is Tor or not.