---
type: User Story
title: Block account additions from anonymized networks
description: User Minecraft-account additions fail closed for VPN, proxy, Tor, or unknown IP classifications.
tags: [security, vpn, proxy, minecraft]
timestamp: 2026-08-02T00:12:32Z
story_id: US-008
status: verified
---

# User Story

As an operator, I want account additions blocked from anonymized networks, so that whitelist identities are established from attributable connections.

# Acceptance Criteria

- [x] VPN, proxy, and Tor classifications block user account additions.
- [x] Unknown or unavailable classification blocks additions rather than failing open.
- [x] Hosting-provider ranges can be blocked through deployment configuration.
- [x] Normal portal use and game login are not denied solely because intelligence is unavailable.
- [x] Blocked users receive a clear recovery message without provider internals.
- [x] Blocked and classification-unavailable attempts create distinct audit events with safe intelligence details.
- [x] Administrative account additions remain available as an authorized recovery path.
- [x] Administrators see enriched risky-network observations collapsed to one latest summary per user.

# Implementation

- [`apps/web/src/lib/ip-intelligence.ts`](../apps/web/src/lib/ip-intelligence.ts)
- [`apps/web/src/app/welcome/actions.ts`](../apps/web/src/app/welcome/actions.ts)
- [`apps/web/src/app/account/actions.ts`](../apps/web/src/app/account/actions.ts)
- Configuration: `PROXYCHECK_API_KEY`, `BLOCK_HOSTING_IPS`, `TRUST_PROXY`

# Validation

The fail-closed classification policy and provider mappings are covered by [`packages/network/test/proxycheck.test.ts`](../packages/network/test/proxycheck.test.ts).

# Related Stories

- [Enrich login IPs](us-007-ip-intelligence.md)
- [Validate Minecraft accounts](us-004-minecraft-validation.md)