Blocking China IP Address Blocks

The Chinese can use a foreign botnet just like anyone else. The fact that so many attacks originate (traceably) from China is probably just down to laziness but that doesn't mean you'll be protected if you block the country outright. Ultimately, individual IP addresses should be blocked for a certain time after your service recognizes anomalies in client behavior (such as multiple login fishing attempts).

That said, it's pretty easy to block countries from accessing web apps at least if you use Cloudflare. The CF proxy passes a special field down to your server containing the country of origin. Works quite well actually.

We were very seriously considering if we should block China from our game servers recently. The reason is massive account compromises of our users.

There are 300,000 IPs from China that are just trying public leaked email / password databases against our servers. With so many IPs, any kind of normal per IP limiting just doesn't work. Each IP is only trying 10 or so accounts per day.

Blocking China was potentially a very real solution because I just don't think that they would have access to other bot nets of that sheer size outside of China.

The trouble is that the users don't understand that they are pre-compromised before they even arrive.

Anyway, we have now implemented a system whereby accounts get locked if someone attempts to log in from a different country than last time and they have to type in a verification code sent to their email.

All the "My account got hacked" support requests have been replaced by an equivalent number of "Why does my account keep getting locked" support requests. But there you go.

We talked about this for a while and decided that, at least at first, we want to lock out the original owner.

The reasoning behind this was that their actual password is compromised. We want to make sure that the user understands this fact and changes their password. Not only on our service, but on all the others that they may be using the same password for as well.

The email does say that someone else has your password, but if you can just ignore the email then most will not actually get it or assume it's some kind of phishing email.

There was a massive password leakage happened in the end of 2011 and early 2012. Probably more than 100 millions of passwords from more than ten popular websites including some popular social network websites, were made available on the internet (BT or eDonkey). The size of the password files added up to 10GB after compressed. Some significant amount of the passwords were in plain text when obtained so that with such a huge dictionary rainbow table can be used to decrypt the a large portion of rest.

So the reality is really nasty. Many of the netizen in China are somehow running naked: you can simply query the password after you get the email.

I was about to link this story back to Path of Exile folks given what's happened there. When I saw your post, I looked at your profile - nice that you're here!

For what it's worth, you should consider locking not on attempt to log in, but on successful login from abroad. This was an old problem in some Windows networks: accounts would be locked with 5 failed logins. People discovered they could lock out friends' accounts (or ahem the president's) by failing a login 5 times.

(P.S. If anyone's looking for a great way to waste more time than they should, Path of Exile is a pretty great game.)