If you use NeoTrace, it will show you nodes and IP addresses where the attacker's connection goes through...i'm not too sure if this could help but its worth giving it a try and checking all those locations....maybe i'm wrong. GL