Hosting provider claims normal use of CiviCRM is "brute force attack"
Sounds a bit like a problem with mod_security, see also

https://forum.civicrm.org/index.php?topic=36028.0

I have also asked a hoster once of one of my clients to switch it off for that site.
But this forum topic even gives options about how to configure mod_security rules to keep it switched on and still have CiviCRM working.