> 1. Blocking Iranian IPs, as opposed to accounts, is almost certainly over-compliance. Note that the vast majority of websites do not do this. Even big ones, such as Gmail, do not do this.

I can tell you for certain that at least AWS and Atlassian do that.

I learned that while surfing from an IP address which was mistakenly associated with being located in Iran. I only discovered that, because said websites weren't available. As I got that fixed quite fast afterwards I haven't done more browsing, that's why I can only name these two companies, but I'm pretty sure there are much more big companies doing such blocking based on IP address geolocation.