diego-parrilla

Diego is a Security Software Architect at the Office of the CTO team (OCTO). It has been a long journey since his dad bought his first eight-bit computer in the early 80s. He joined Auth0 after the acquisition of Apility.io in October 2019, and now he is looking for new ways to improve how Auth0 detects and stops potential threats. When he's not working, Diego loves participating in open source communities, riding his mountain bike, listen 80s and 90s hard rock music, watching NBA games, and traveling with his wife and teenage daughter.

Security Software Architect at OCTO

Diego Parrilla

Assess your users' reputation using the Auth0 Signals Email Verification API.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

**TL;DR:** How often do you feel that there is something wrong with the email address of that new customer? The username and the domain look suspicious. With the new risk assessment features of the Email Verification API, you can get enough insights to make informed decisions about your users in real-time.

## The Problem

There is a rising wave of abusers that sign up to services offering freemium or free-trial. Typically they want to exploit the resource you offer (compute, streaming, APIs, etc). The tension lies between converting more vs stopping these abusers.

One way to stop them, without introducing much friction, is to verify if their email is legitimate (without sending all users an email). This is what the Auth0 Signals Email Verification API provides.

## What is the Auth0 Signals API?

The [Auth0 Signals API](https://auth0.com/signals) is a standalone free service for the community. The service consists of an HTTP API that allows you to detect the reputation of an Email address or the IP address. The API checks the Email and/or IP address against several public denylists to evaluate its reputation. It responds with data about the originator and a score indicating the reliability level of the Email or IP address. Having this information enables you to detect malicious activities proactively.

## When to use Email Verification signal?

The Email Verification signal provides a continually curated and accurate Email reputation data. It takes the hard work out of consuming Open-Source Intelligence (OSINT) by curating, parsing, and normalizing numerous denylists. Auth0 uses this data to protect its own service.

There are two main use cases for this API:

- **Real-time risk assessment:** Developers can embed into their code requests to the API and detect malicious activity proactively, not reactively. For example, automatically checking Email reputation during the authentication flow. With a disclaimer that it’s free, no SLA and rate limits are in place.
- **Incident response and forensics:** When security experts identify an incident, they begin investigation and response processes to determine if a genuine security incident occurred, its scope, and the best way to remediate the threat. The API and some assessment tools will become part of the Security professionals swiss army knife.

Auth0 Email verification signal enables all users to obtain a score that indicates the risk level of an analyzed Email address. The overall process involves an in-depth analysis of each email,  combining several validation techniques based on custom-built algorithms scoring the legitimacy of an email. Clean and valid email addresses will have a neutral score. Suspicious addresses will have a negative rating: the more negative the score, the more probability of being an address with a low reputation.

## How does the Email Verification API work?

First [sign up in Auth0 Signals and get an API Key](https://auth0.com/signals). If you have any doubt, you can [read this short tutorial detailing all the steps](https://community.auth0.com/t/how-to-obtain-an-auth0-signals-api-key/42048)
The [API documentation in the Auth0 Signals site](https://auth0.com/signals/docs/#email-verification) explains how to use the service with or without an API Key. For example, let’s get the score for the email ```test@example.com```. We will assume that ```example.com``` is a very well known [Disposable Email Address](https://en.wikipedia.org/wiki/Disposable_email_address) provider, so it should have a negative rating. To test the API, we will use the command ```curl```. The requests need two parameters: the Auth0 Signals API Key and the Email to analyze. It’s also possible to add parameters in the query string to tweak how the service works.

```shell
$ curl -i -H "Accept: application/json" -H "X-Auth-Token: API_KEY" -X GET "https://signals.api.auth0.com/bademail/test@example.com"
```

or

```shell
$ curl -H "Accept: application/json" -X GET "https://signals.api.auth0.com/bademail/test@example.com?token=API_KEY"
```

the JSON response will be:

```
{
   "response":{
      ...
      "score":-3,
      "email_address":"test@example.com"
   },
   "type":"bademail"
}
```

We have trimmed the JSON object of the response to make this post more readable, but you can [read the full JSON response in the documentation](https://auth0.com/signals/docs/#email). The global score is ```-3```. That’s a bad score. Let’s see how the scoring formula works in detail.

## The scoring formula explained

The global score or confidence score is the sum after analyzing different parameters of the Email address. These are the possible values:

- **0:** Auth0 Signals is neutral about the Email address given. It means the service cannot find the Email address in any given individual service and cannot classify the Email as risky.
- **-1:** Auth0 Signals has detected the Email address in one of the checks.
- **lower than -1:** Auth0 Signals has detected the Email address in two or more checks. The lower the score, the riskier the Email.

The possible values range between -3 and 0, and there are no positive values because the algorithm does not calculate confidence levels, but rather levels of DISTRUST.

The email verification process analyzes different elements of an email address assigning a neutral or negative score for each part:

- **Address:** If any of these checks fail, the score of this test is -1.
  - **Address Syntax:** This check removes improperly formatted email addresses. It must adhere to [IETF standards](https://tools.ietf.org/html/rfc2822).
  - **Role-Based Account:** Email sent to role-based such as postmaster@, info@, sales@, admin@, etc. can negatively impact the deliverability, and even some ISPs will block them. This process detects and flags such addresses.
- **Domain:** test for the MX domains, and NS domains. If any of these checks fail, the score of this test is -1.
  - **Domain banned:** The process searches the domain in different deny lists. To be a clean domain, it must not appear in any of them.
  - **MX domain banned:** It searches the MX domains in different deny lists too. Clean MX domains must not appear in any of them.
  - **NS domain banned:** It searches the NS domains in different deny lists too. Spammers use very well-known suspicious Nameservers, and we also can block them.
- **Free Email Service:** detects emails hosted by Free Email Services like (Google, Yahoo, Hotmail/Microsoft, etc.). Since this is a very aggressive option, the algorithm does not compute the result as negative, but it flags the email to help users to make a decision.
- **Disposable Email Address:** Throwaway/disposable email addresses, or “junk collector” email addresses" are detected and processed appropriately. It is a widespread threat indicator of bad actors using them to bypass signup forms or login forms that require a valid email address. The score for this test is -1.
- **Banned Email Address:** If the Email address belongs to some of our Email Abuse deny lists, then the score for this test is -1.
- **SMTP Verification:** Performs deep-level extended SMTP verifications on the email address. The process pings the addresses for mailbox existence without sending an actual email to the inbox. It will also check the validity of the MX records and will test if the server implements a catch-all policy. The score for this test is -1 for any of them.
- **Lookup IP in OSINT deny lists:** The algorithms check the email addresses and IP addresses against known DNSBLs and RBL to trap spam networks. The score for this test is -1 for any of them.

## Using the Email Verification API in your application

It’s perfectly fine to use the API in your own services. If you are a developer, here goes some hints to get the most of the Email verification service:

- You can verify 4,000 emails in a 24-hour range. Use your quota wisely.
- The global score or confidence score should be considered an important signal. Still, we strongly recommend reviewing the different individual scores as you process production traffic to better understand the email address's reputation for your use case. Our general-purpose scoring formula can be too generic for some use cases.   
- You can ignore the global score and focus on individual tests. For example: if you want to detect emails from Free Email providers, you can check the ```freemail``` object in the JSON and ignore the rest of the response.
- Have a look at the [Querystring parameters](https://auth0.com/signals/docs/#check-if-an-email-scores-a-negative-or-neutral-score). This can help you adjust the results to your specific needs. 
- Auth0 Signals is free for all and offered 'as is' with no SLA. This means you should make your code resilient in case the API stops responding.
- For production-grade usage use the Auth0 service that includes Signals built-in. 

## The Email Verification tools: Slack Bot
The [Signals Slack Bot](https://auth0.com/signals/ip#signalsbot-slack-landing) is a new tool built on top of the Signals API for Cybersecurity Professionals, SecOps, analysts, and forensics teams willing to use the bot to get the most of the API without having to write a single line of code. The tool uses the Email Verification and IP Reputation APIs combined with some interactive features to drill down on the data. The installation is very straightforward following the [instructions on our community site](https://community.auth0.com/t/auth0-signals-slack-bot/45216).

![The installation page of the SignalsBot App](https://images.ctfassets.net/23aumh6u8s0i/1MhWa1qfDbbAaxaSMG1xcc/b5d1cb6ebfb99b28824293dee6c4ac3f/signals-installation-page)

Once the Slack Bot is installed and configured, any member of the Slack workspace can go to the SignalsBot in the Apps section and click on the Messages tab at the right-hand side of Home and execute the ```email```(lowercase) command with the email to analyze:

![Auth0 Signals Email verification score](https://images.ctfassets.net/23aumh6u8s0i/4jQkOPsEDZy6FopipmFhQj/38d05be24c61028cfcc372cd68875954/signals-email-score)

## Summary

The Email Verification API is a powerful tool to prevent and mitigate sign-up and sign-in abuse at different stages. If the API integrates with the existing authentication workflow it can help to detect potential low-quality users. When the API or the tools are in the hands of Security professionals it can help SecOps teams perform threat intelligence duties more effectively. Be sure to [check out the documentation](https://auth0.com/signals/docs) for more details.

## Join the community!

[Check out the Auth0 Signals community](https://community.auth0.com/c/auth0-signals/78). Go there to interact with other security professionals, get help on incident response actions, or learn more about digital abuse.


Introducing Auth0 Signals Email Verification API

0cd73f2f2f39709bd03646e9225cc3d3?s=200 avatar

0cd73f2f2f39709bd03646e9225cc3d3?s=200

I’m an engineer with a passion for building frictionless products. I’ve built effective teams and have grown them into successful engineering organizations. I like to forge a culture.

CTO and Co-founder

Matias Woloski

We acquired Apility.io, an anti-abuse API company that will help us bolster our security strategy to protect against automated cyberattacks.



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Important Information</strong><br> 
  <b>The Apility.io and Signals web properties and public APIs are no longer available. For more details, please refer to this <a href="https://auth0.com/blog/auth0-sunsets-signals/">blog post</a>.</b><br> 
</div>

Today we are announcing the acquisition of Apility.io, an anti-abuse API company. This is our first acquisition, bolstering our security strategy to protect against automated and targeted cyberattacks, including credential stuffing and sophisticated phishing attacks.

Apility.io is now a part of Auth0 Signals, a new collection of dynamic data feeds that fuels [Auth0's Anomaly Detection Engine](https://auth0.com/learn/anomaly-detection/) to detect and prevent sophisticated cyberattacks. In addition, part of Auth0 Signals will be made available as a community version via free APIs to help anyone better protect themselves from threat actors.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**

## What is Auth0 Signals?

Auth0 Signals is a collection of dynamic data feeds that enable our adaptive authentication pipeline to produce high-quality user confidence scores.

Our authentication pipeline processes an ever-expanding number of Signals to assess the risk of a login attempt, account creation, token refresh, or elevation of privilege. It then produces a confidence score. Using this score, Auth0 and our customers can perform risk-based adaptive authentication decisions.

<script src="https://fast.wistia.com/embed/medias/h5fqhdgsep.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:74.37% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_h5fqhdgsep videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

## Introducing Auth0 Signals Community Version

Today we are introducing a standalone community version of part of the signals we use in our pipeline. More specifically, the **IP reputation signal**. This comes from our acquisition of Apility.io and provides a continually curated and accurate IP, email, and domain reputation data. It takes the hard work out of consuming Open-Source Intelligence (OSINT) by curating, parsing, and normalizing numerous blacklists from across the dark web. We use this data to protect our own infrastructure.

![DIAGRAM](https://images.ctfassets.net/23aumh6u8s0i/5hDiy0cE8lezc61zjwTGnt/168830a9782a26dc67f38d74db746504/diagram-blacklist)

## Why Did We Build Auth0 Signals?

Auth0 Signals and anomaly detection are the foundation of developing a robust adaptive authentication system, ultimately enhancing our continuous authentication capabilities. The goal of adaptive authentication is to continually adapt to a changing threat landscape instead of using a simple rules-based system to block specific interactions.

For example, simple brute force protection usually relies on blocking high-velocity requests above a certain threshold, such as 100 authentication attempts per minute for a single IP address. The problem with this approach is threat actors can create scripts to identify this threshold and then adapt their botnet to operate below it. Effective adaptive authentication takes other risk signals into account, such as IP reputation data.

One of the most pressing threats Auth0 Signals will help address is [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/). In credential stuffing attacks, threat actors use stolen credentials from one breach to break into users' other accounts. [This is effective because 65% of people reuse passwords across multiple accounts, according to Google](https://www.forbes.com/sites/daveywinder/2019/02/05/google-reveals-a-big-problem-with-passwords-on-safer-internet-day/#297a05f85e0b). Even the largest companies are vulnerable if they don't have the right preventative measures in place.

As a central authentication service that processes billions of logins per month, we are in a good position to observe trends in credential stuffing attacks targeting our customers' identity implementations. [On some days, these attacks originate from more than 50,000 IP addresses and may account for as much as half of all login attempts using our platform](https://auth0.com/resources/whitepapers/credential-stuffing-attacks).

Auth0 Signals, coupled with the Anomaly Detection Engine, will detect these attacks with a high degree of efficacy early in the authentication pipeline. IP addresses identified as participating in a credential stuffing attack will be forced to solve a CAPTCHA, which addresses the vast majority of these attacks.

## Try the API Now. It's Free!

Auth0 IP Signals will assist security analysts with incident response and forensic investigations, as well as provide application security engineers with proactive abuse prevention accessed via an API.

<script src="https://fast.wistia.com/embed/medias/v6ilxd3jhu.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:60.83% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_v6ilxd3jhu videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
 <br>
 
### Incident response and forensics 

When a security incident is identified, security analysts begin investigation and response processes to determine if a legitimate security incident occurred, the scope of the incident, and the best way to remediate the threat.

Using the _Auth0 IP Signals_ tool, security analysts can submit IP addresses involved in such incidents to quickly identify traffic from known threat sources.

### Abuse prevention

Using _Auth0 IP Signals API_, security professionals can detect malicious activity proactively, not reactively. For example, automatically checking IP reputation during the authentication flow can help prevent common threats, such as credential stuffing attacks.

## Final Thoughts

Last year, I wrote about [our vision for our identity platform](https://auth0.com/blog/the-developer-first-identity-platform-auth0-story-and-future/) and how we want to help security professionals by providing them with a single pane of glass that alerts them and self-remediates any sort of identity attack. This is a step towards fulfilling that vision. I am very excited about what's coming this year to help you all making your applications safer.

**To try out Auth0 IP Signals, our first free Signals API, visit [auth0.com/signals/ip](https://auth0.com/signals/ip)**


"ip-signals"