OK, here's what happened.
I need to be able to script SFTP transfers on an Amazon EC2 server instance, running Server 2008. So, firstly used Filezilla (my default "go to" FTP client) to ensure everything was working. Filezilla connected fine, and I could download files no problem. So, installed WinSCP 5.7.7. It asks me if I want to import settings from Filezilla so I say "yes". It does so and I try to login to my secure site - fails. So I go back to Filezilla - and it also fails!
So I try a standard FTP site on one of my other servers. Filezilla won't connect to that either . I assume it's a problem in the firewall - so I set windows firewall to allow all, I open all ports in the EC2 firewall. Still the same - neither the secure nor the non-secure sites will connect.
I think "bugger" and decide to create a new EC2 instance running Server 2012. I do this - download Filezilla and connect fine to the secure site. I think "great". I then reassociate the elastic IP address of the first server/instance with the second so I don't have to change DNS. I try Filezilla again - won't work. I think "bugger" again, and change IP address of the server. It now works fine. So I conclude that somewhere, somehow, the IP address has been blocked.
I request a new elastic IP address and associate this with the new server/instance. Everything works fine. So I install WinSCP on this new server. I import Filezilla settings, and try and login to the secure site with WinSCP - it fails. I go back to Filezilla and it also fails. Remember, I've done nothing other than change the IP address - both the 2008 and the 2012 servers are using the same firewall config.
So I create a new elastic IP address, associate it with the new 2012 server and everything works fine. I uninstall WinSCP, filing it mentally under "dangerous software" and install Bitvise which works like a charm.
The conclusion I have is that somehow, WinSCP is causing the IP address of the server to be blocked. I don't know how, I don't know why. But I do know I'm SERIOUSLY annoyed.