[dspillett]

If many hosts get abused (usually due to people setting up a quick VM for a task and forgetting to update it manually and not setting up automatic security patching) even a reputable hosting service becomes a script-kiddie farm.

Perhaps this has happened with DO and Apple have blocked its host address ranges from the API due to unwitting past involvement in hack/DDoS attempts?

This is common with public VPN services that people I know have used. I have the luxury of fixed addressing and decent bandwidth at home, so I run my VPN there and have thus far not noticed any such issues. This also means that services that are location sensitive work as if I'm at home (not some random other place the VPN endpoint appears at).