
JasonA.65922 (Customer) asked a question.
We've recently (few months) have been receiving rate limit violation warnings and when we looked at the logs, it shows that there have been repeated attempts from foreign countries. It's clearly not our users and it counts against our rate apparently. Does Okta have some kind of real time block list? The attempts we see are coming from asia, so there has to be some mechanism that blocks these type of attempts?

Under the Security tab, select Networks. If you don't already have one, you can create a network zone that blacklists connections based on either dynamic location data or even specific IP addresses. You can find more information here: https://help.okta.com/en/prod/Content/Topics/Security/Security_Network.htm?cshid=Security_Network
With an IP blacklist zone set up, you can add IP addresses to it right from within the system log. Just expand the log entry, locate the source IP address, and when you hover your mouse over the address, click the box containing the three dots, then click on Add to zone.
Blacklisted addresses are blocked at the router, so they never get to your API endpoints.