They should just make it 360 seconds for the account no matter what IP as it isn't hard to login on a phone or change your IP with a VPN and bypass this rule.