We employ a system firewall on all of our free hosting servers which will ban any IP addresses that show any suspicious activity.
Should suspicious activity derive from a particular IP address (ie. attempted brute force attempts where multiple failed logins are submitted in a short period of time) our firewall will automatically block the offending IP address.
Our firewalls on our servers and our abuse team do their best to defend servers from incoming attacks and attempt to neutralise them as quickly as possible. The impact an attack will have is dependent on how dynamic the attack is.
they tried even getting in to CPanel today!
How do you know this? You should ensure that your cPanel credentials are as secure as possible, with long password with symbols etc.
If it is a
DDoS attach (hence the D at the start, which stands for
Distributed), a single IP address would not be very helpful in blocking the user, since if an attack is Distributed the attack is spread between multiple IP addresses. If we banned just one IP address, the user could easily just switch to another IP at his disposal.
I guess
you could contact his ISP if you have any hard proof. I'm not really an expert with (D)DoS attacks, so someone else might be able to help. I'm not sure if I'm entirely correct here, sorry.