We're receiving (and have experienced ourselves) site visitors complaining that they've been blocked by Defender, with this message:
"The administrator has blocked your IP from accessing this website."
My own IP was blocked, as well. I was able to log and clear the blacklist, which got everybody back in, even though my IP address (and some readers) were NOT on the blacklist itself. There was a huge number of failed login attempts blocked overnight, but again—not from my IP or the site readers' IPs.
This is an issue that's come up on a few of our sites now, and the only change made to these sites was the upgrade from WordPress 4.9 to 5.0.2.
Thanks for your help.