I have an API that is somewhat popular (10,000+ requests/day). After 10 requests per day from an IP address I return a message telling the user they need to cough of some cash i
They might be using Chinese IP addresses now, but ban one country and eventually another country will be the problem. Mostly because country has nothing to do with it; the user is the problem. Instead of banning IP ranges, you should detect IP addresses that are increasing by one octet each time they outlive a free trial.