We experienced similar attacks and the easiest solution that fixed the problem was to completely block China and some other countries at the firewall level. We are a B2B app in the US and never had a paying customer from Asia. It's been a year since we did this and the spam attempts have ceased since then.