I'm afraid this is pretty common on the Internet today. I recently set up my own web server and I was a little shocked to look at some of the logs (in terms of

I'm afraid this is pretty common on the Internet today. I recently set up my own web server and I was a little shocked to look at some of the logs (in terms of the level of malice and persistence, like hundreds of different attacks attempted by a single attacker) even though I had often heard about this phenomenon before. You could try to complain about the abuse to the SWIP owner of that IP address space in whois. Note that some ISPs and countries may not care much. Perhaps this bot is already deliberately hosted in one that doesn't care. Also maybe consider using something like fail2ban, a leading tool for automating some attack-bot blocking: https://www.fail2ban.org/wiki/index.php/Main_Page https://www.fail2ban.org/wiki/index.php/Main_Page Although it's a much-debated topic, I don't think that the escalation of "hack-back" is reasonable ethically or even tactically. One important problem is that you don't even know for sure that the apparent origin of the attacks is an entity that's deliberately involved at all. It could be a legitimate server (that someone relies on) that the attacker has previously compromised in order to abuse it to attack you. The main person who suffers if you succeed in a hack-back might be the legitimate operator of that server, who may also be an innocent victim (and might think of you as a malicious attacker for trying to disable the server!).