IPs can be blocked based on the following reasons:
Failed registrations
Failed Web Suite login and failed API login attempts
It is important to note that for an IP to become blocked it must be actively trying to either reigster or login and fail. This does not prevent other common forms of server attacks such as SIP and IMAP attacks and network security should still play a big role in protecting the server.
In a SIP attack, for example, there may be no request to register a phone or login and scripts may be used to flood the server by generating outbound calls thus the IP may not be blocked. Utilizing ACCESS CONTROL can help prevent the Switchvox from attack
Access Control: What is Purpose of Access Control Feature