Ban the repeated login. Do not ban the office IP and call it secured.
SSH, the panel, and Postfix or Exim submission. A jail that ignores the log path the panel actually writes is not running.
The jail, the log, an ignore list
The default jail, pointed at the right log. Password login should already be off. Fail2Ban is the second layer, not a substitute for keys.
Hestia, DirectAdmin and cPanel log failed logins in their own file. A jail on /var/log/auth.log never sees them. We point it at the panel log.
Your office and the monitoring host, if they are stable. A dynamic home IP does not belong there. We leave a way to unban from the provider console.
The provider console is the unblock. Not a reinstall.
A jail that banned your IP is one command from the web console. We do not flush every jail because one address was caught. Recidive and a mail jail are added only if the log shows the abuse.
€55 an hour. Usually inside the hardening hour.
Minimum 1 hour if it is the whole job. A ban of your own IP, with console access, is a short fix at the same rate.
Fail2Ban missing, or it banned the wrong address?
Tell us the panel. If you are locked out, say whether the provider console still works. No root password in the first message.