https://developer.apple.com/icloud/prepare-your-network-for-... has a guide for web server operators, including a GeoIP CSV which could conceivably be used for whitelisting. More concerning is that they're plugging private access tokens there, which allows Apple to vouch that you're a human running their hardware.