diff --git a/src/db/common/serverdbgeneric.cpp b/src/db/common/serverdbgeneric.cpp
index 92f401c9..c31503a0 100644
--- a/src/db/common/serverdbgeneric.cpp
+++ b/src/db/common/serverdbgeneric.cpp
@@ -54,6 +54,12 @@ ServerDBGeneric::AsyncPlayerLogin(unsigned requestId, const string &/*playerName
 	m_ioService->post(boost::bind(&ServerDBCallback::PlayerLoginFailed, &m_callback, requestId));
 }
 
+void
+ServerDBGeneric::AsyncCheckAvatarBlacklist(unsigned requestId, const std::string &/*avatarHash*/)
+{
+	m_ioService->post(boost::bind(&ServerDBCallback::AvatarIsBlacklisted, &m_callback, requestId));
+}
+
 void
 ServerDBGeneric::PlayerPostLogin(DB_id /*playerId*/, const std::string &/*avatarHash*/, const std::string &/*avatarType*/)
 {
diff --git a/src/db/serverdbcallback.h b/src/db/serverdbcallback.h
index ef3bba0b..78cfba4d 100644
--- a/src/db/serverdbcallback.h
+++ b/src/db/serverdbcallback.h
@@ -40,6 +40,9 @@ public:
 	virtual void PlayerLoginFailed(unsigned requestId) = 0;
 	virtual void PlayerLoginBlocked(unsigned requestId) = 0;
 
+	virtual void AvatarIsBlacklisted(unsigned requestId) = 0;
+	virtual void AvatarIsOK(unsigned requestId) = 0;
+
 	virtual void CreateGameSuccess(unsigned requestId, DB_id gameId) = 0;
 	virtual void CreateGameFailed(unsigned requestId) = 0;
 
diff --git a/src/db/serverdbgeneric.h b/src/db/serverdbgeneric.h
index c1ac3fb3..228cada1 100644
--- a/src/db/serverdbgeneric.h
+++ b/src/db/serverdbgeneric.h
@@ -39,6 +39,7 @@ public:
 	virtual void Stop();
 
 	virtual void AsyncPlayerLogin(unsigned requestId, const std::string &playerName);
+	virtual void AsyncCheckAvatarBlacklist(unsigned requestId, const std::string &avatarHash);
 	virtual void PlayerPostLogin(DB_id playerId, const std::string &avatarHash, const std::string &avatarType);
 	virtual void PlayerLogout(DB_id playerId);
 
diff --git a/src/db/serverdbinterface.h b/src/db/serverdbinterface.h
index 3a8494d4..d576085a 100644
--- a/src/db/serverdbinterface.h
+++ b/src/db/serverdbinterface.h
@@ -39,6 +39,7 @@ public:
 	virtual void Stop() = 0;
 
 	virtual void AsyncPlayerLogin(unsigned requestId, const std::string &playerName) = 0;
+	virtual void AsyncCheckAvatarBlacklist(unsigned requestId, const std::string &avatarHash) = 0;
 	virtual void PlayerPostLogin(DB_id playerId, const std::string &avatarHash, const std::string &avatarType) = 0;
 	virtual void PlayerLogout(DB_id playerId) = 0;
 
diff --git a/src/db/serverdbnoaction.h b/src/db/serverdbnoaction.h
index fc1cef50..3b0aadee 100644
--- a/src/db/serverdbnoaction.h
+++ b/src/db/serverdbnoaction.h
@@ -37,6 +37,7 @@ public:
 	virtual void Stop() {}
 
 	virtual void AsyncPlayerLogin(unsigned /*requestId*/, const std::string &/*playerName*/) {}
+	virtual void AsyncCheckAvatarBlacklist(unsigned /*requestId*/, const std::string &/*avatarHash*/) {}
 	virtual void PlayerPostLogin(DB_id /*playerId*/, const std::string &/*avatarHash*/, const std::string &/*avatarType*/) {}
 	virtual void PlayerLogout(DB_id /*playerId*/) {}
 
diff --git a/src/net/common/serverlobbythread.cpp b/src/net/common/serverlobbythread.cpp
index 23040a26..880b55bc 100644
--- a/src/net/common/serverlobbythread.cpp
+++ b/src/net/common/serverlobbythread.cpp
@@ -147,6 +147,16 @@ public:
 		m_server.UserBlocked(requestId);
 	}
 
+	virtual void AvatarIsBlacklisted(unsigned requestId)
+	{
+		m_server.AvatarBlacklisted(requestId);
+	}
+
+	virtual void AvatarIsOK(unsigned requestId)
+	{
+		m_server.AvatarOK(requestId);
+	}
+
 	virtual void CreateGameSuccess(unsigned requestId, DB_id gameId)
 	{
 		m_server.SetGameDBId((u_int32_t)requestId, gameId);
@@ -1158,7 +1168,7 @@ ServerLobbyThread::HandleNetPacketAuthClientResponse(SessionWrapper session, con
 			GetSender().Send(session.sessionData, packet);
 			// The last message is only for server verification.
 			// We are done now, the user has logged in.
-			InitAfterLogin(session);
+			CheckAvatarBlacklist(session);
 		}
 		else
 			SessionError(session, ERR_NET_INVALID_PASSWORD);
@@ -1543,6 +1553,33 @@ ServerLobbyThread::AuthChallenge(SessionWrapper session, const string &secret)
 	}
 }
 
+void
+ServerLobbyThread::CheckAvatarBlacklist(SessionWrapper session)
+{
+	if (session.sessionData && session.playerData)
+	{
+		const MD5Buf &avatarMD5 = session.playerData->GetAvatarMD5();
+		if (!avatarMD5.IsZero())
+			m_database->AsyncCheckAvatarBlacklist(session.playerData->GetUniqueId(), avatarMD5.ToString());
+		else
+			InitAfterLogin(session);
+	}
+}
+
+void
+ServerLobbyThread::AvatarBlacklisted(unsigned playerId)
+{
+	// TODO use proper error code.
+	SessionError(m_sessionManager.GetSessionByUniquePlayerId(playerId, true), ERR_NET_AVATAR_TOO_LARGE);
+}
+
+void
+ServerLobbyThread::AvatarOK(unsigned playerId)
+{
+	SessionWrapper tmpSession = m_sessionManager.GetSessionByUniquePlayerId(playerId, true);
+	InitAfterLogin(tmpSession);
+}
+
 void
 ServerLobbyThread::InitAfterLogin(SessionWrapper session)
 {
diff --git a/src/net/serverlobbythread.h b/src/net/serverlobbythread.h
index 34e3b2ed..c4a0548f 100644
--- a/src/net/serverlobbythread.h
+++ b/src/net/serverlobbythread.h
@@ -143,13 +143,18 @@ protected:
 	void HandleNetPacketJoinGame(SessionWrapper session, const std::string &password, const JoinExistingGame_t &joinGame);
 	void HandleNetPacketChatRequest(SessionWrapper session, const ChatRequestMessage_t &chatRequest);
 	void HandleNetPacketRejectGameInvitation(SessionWrapper session, const RejectGameInvitationMessage_t &reject);
+	// TODO would be better to use state pattern here.
 	void AuthChallenge(SessionWrapper session, const std::string &secret);
+	void CheckAvatarBlacklist(SessionWrapper session);
+	void AvatarBlacklisted(unsigned playerId);
+	void AvatarOK(unsigned playerId);
 	void InitAfterLogin(SessionWrapper session);
 	void EstablishSession(SessionWrapper session);
 	void AuthenticatePlayer(SessionWrapper session);
 	void UserValid(unsigned playerId, const DBPlayerData &dbPlayerData);
 	void UserInvalid(unsigned playerId);
 	void UserBlocked(unsigned playerId);
+
 	void SendReportAvatarResult(unsigned byPlayerId, unsigned reportedPlayerId, bool success);
 	void RequestPlayerAvatar(SessionWrapper session);
 	void TimerRemoveGame(const boost::system::error_code &ec);