If it's an address on the internet... otherwise as people have noted using dig will generally get you a reverse dns entry for it which may or may not contain useful information. whois -hwhois.arin.net ipaddr You may also want to consider installing something like fail2ban to just nix his ip about every 3rd-4th fail.