We experienced similar attacks and the easiest solution that fixed the problem was to completely block China and some other countries at the firewall level. We

We experienced similar attacks and the easiest solution that fixed the problem was to completely block China and some other countries at the firewall level. We are a B2B app in the US and never had a paying customer from Asia. It's been a year since we did this and the spam attempts have ceased since then.