The Meta family 7-country hard block
Mainland China (gradual since 2009-07 Urumqi, FB/IG/WhatsApp/Threads fully blocked, only Messenger Lite occasionally seeps through on HTTP in some cities), North Korea (full-state firewall), Iran (2009 Green Movement onwards, tightened post 2022 Mahsa), Russia (2022-03-04 Roskomnadzor total block, upgraded 2025-09 to RUB 5000 fine for VPN-accessing Meta products), Myanmar (junta block since 2021-02 coup), Turkmenistan (perennial), Uganda (2021-01 pre-election, never reversed). Same BLOCKED_REGIONS across IG/Messenger/WhatsApp — Meta shares one risk backend.
Account region lock — your phone number decides your 'home'
The phone number you register with pins your account's 'Primary Location' in Meta's backend — this field influences ad targeting, friend suggestions, and local news trending. Register with +86 Chinese number and Facebook knows you're Chinese even behind a US VPN (you'll see Chinese ads, Marketplace localizes to China). Better: register with a destination-country number from the start (Google Voice US / Twilio virtual / overseas physical SIM) — never convert later. First 90 days of a new account all 'unusual' behavior is scrutinized — IP change, device change, unverified email, any single one can trigger Checkpoint.
AF3 node recommendation (3-star)
IP scoring: residential 30 / quality_vpn 28 / normal_vpn 25 / datacenter 22 — relatively loose. FB's core anti-abuse isn't IP-type — it's 'account behavior fingerprint': login cadence, device UA, mouse trails, typing rhythm, friend graph. Node selection: (1) stability > location — same node for 2 weeks beats switching daily; (2) pick high-traffic target countries (US/India/Indonesia/Brazil/Mexico combined exceed 1.5B FB users), small-country nodes get flagged as anomalous; (3) avoid well-known datacenter ranges like AWS us-east-1 / DO NYC3 — Meta's most sensitive. If WhatsApp shows MTProto-adjacent traffic behavior, account temp-limits cascade — FB/Messenger both affected.
Checkpoint verification — FB's 'soft wall'
When FB suspects anomaly it pushes Checkpoint: (1) SMS to bound phone (most common, you receive); (2) friend photo ID (name 3 friends by face); (3) selfie face match (upload + biometric compare); (4) government ID (strictest, final). Triggers: IP jump (Beijing → LA within 24h), device swap (mobile → new PC), abnormal login density, mass friend requests. To unlock: (1) VPN back to registration country so IP matches signup, then appeal; (2) wait out the cooldown (30-90 days sometimes, occasionally permanent). Prevention: stick to one node, don't farm friends/likes, and Checkpoint never finds you.
2025 Russia escalation and cross-border risk
2025-09 Putin signed a law making VPN use to access 'designated extremist organizations' (including Meta, Facebook, Instagram) an administrative offense with RUB 3000-5000 fines (~$35-60), escalating to criminal on repeat. This is the first global 'VPN-for-social' legislation. For users inside Russia: risk upgraded from 'IP gets blocked' to 'you get fined'. Advice: (1) use obfuscation protocols (V2Ray Reality / Xray / Shadowsocks-AEAD), avoid pure WireGuard/OpenVPN signatures; (2) don't post politics domestically, isolate overseas activity; (3) enable 2FA but skip Russian numbers — use international eSIM. The other 6 blocked countries don't currently have equivalent per-person criminalization — mostly technical risk.