Do you have any direct evidence that the Orange block is due to the listing in UCEPROTECT?

Digital Ocean is not a great neighborhood.

After seeing periodic bursts of login attempts from there, I now block all inbound ssh from AS14061 (among several such bad neighborhoods) as no authorized clients are hosted there and there is a constant level of attempted attacks from there.