I report DO hackers all the time. However, it doesn’t make sense they have different IP addresses. At least my droplet has a static IP. {Oh, and a good reason to behave yourself.)

For a website, there is nothing wrong with blocking a VPS IP space entirely. If someone has a VPN on it, too bad for them. They can just drop their VPN. Note you go to bgphe.net and block the entire IP space. AWS is a little different. You need to retrieve their IP space in json format. I haven’t done google in a while, but you get their hosting via a SPF record. But just about everyone else can be found on bgp.he.net or similar websites.

My argument is there are no eyeballs in datacenters, VPS, etc. I don’t block DO because as a customer, I can complain about the hacking. But AWS, Linode, etc. are all blocked. Not only from port 80, but all email ports other than 25. This greatly reduces the chatter in the server logs.

I have geographical blocking on all email other than port 25. I stop about 20 hackers a day. Not significant, but these IPs don’t need imap access.

I maintain two ipfw tables. One for port 80 and all email other than 25. The other table doesn’t include port 80. For example, the University of Michigan tries to log into my imap server times a day. Could be hackers…could be research…they never answer my emails. So I block the University of Michigan from my email but not the web server.

I just got an internet security alert that an IP address to this company Digital Ocean hacked my business email. If they have been hitting your website that persistently it is likely they are at your email as well.