Yes, as long as they can recognise them. It's possible to selectively reveal IPs to customers, so an attacking ISP would need the perspective of multiple users

Yes, as long as they can recognise them. It's possible to selectively reveal IPs to customers, so an attacking ISP would need the perspective of multiple users to find all VPN hosts. At an extreme, ISPs could run a whitelist instead of a blacklist (allowing connections only to approved hosts; denying by default). It's possible for services to be run on the same IPs / ports as legitimate services, forcing an ISP to choose between blocking both or none. An example of this is Telegram's use of AWS IPs, which when blocked by Russian ISPs caused disruption to other services. ( https://www.theregister.co.uk/2018/04/17/russia_blocks_google_aws_ip_addresses_to_get_telegram/ https://www.theregister.co.uk/2018/04/17/russia_blocks_googl... )