If a single address is hammering your site, scraping content or brute-forcing a login, you can block it yourself.
In cPanel open IP Blocker. It accepts a single address, a range, or CIDR notation. The block takes effect immediately.
To find the offending address, look at Raw Access Logs or the Errors page in cPanel and look for an address appearing far more often than any other.
Blocking an entire country is possible - the country blocking feature or a firewall plugin will do it - but think it through first. It stops a genuine category of noise, and it also silently blocks customers travelling, people on VPNs, and search engine crawlers routed through that region. For most businesses it costs more than it saves.
Better tools for the common cases:
- Brute force on a login page - rate limiting or a login-attempt limiter, which handles the whole class of attack rather than one address.
- Comment or form spam - a CAPTCHA and a spam filter.
- Sustained large-scale attack - open a ticket. Server-level mitigation is far more effective than anything inside cPanel.
