CAPTCHA anyone? Check out https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks#Sidebar:_Using_CAPTCHAS

This was so common on HostGator to that point that in 99.9% cases client gets blocked as well despite of having an whitelist IP.
Cheers,
Emil