If you are on a *nix environment, you can do a traceroute IP, which will give you all of the hops to that ip. The nearest ISP near that ip, would be the place to direct your initial legal targeting. For the most part though, alot of these hackers use run-of-the-mill bots/worms to propogate their shit onto other peoples servers. So, most likely, you'd find that the IP belongs to some other unknowing victim. The hacker bastards usually use those servers as relays for additional services or temporary warez sites, and the obnoxious/young hackers also like to screw with the people they encounter along the way (if they didn't mess with your site, they could continue parasitically abusing your server without anyone knowing). Thats the route they'd take if they got it in via some ssh bruteforce login or telnet. I'd rule out form-injection exploits because they'd only be able to screw with your database or possibly execute some malicious code with reduced permissions that webservers usually employ (no sane webserver would run with root).
You can probably check your processes (ps -awux) for any rampant perl processes or servers running that you might not be aware of. OR, you can check for a bot payload in /tmp, or /var/tmp, they'll usually dump their stuff there in a zip, expand it, then run it. Also, try 'netstat -a', to get a list of physical network connections that are being made on various ports. You'll see the usual suspects (dns, smtp, web), but you might see other stuff indicating some sort of rebroadcasting or bot activity.
The super easy solution, though, given that you already have the offending IP address is to block it with a software firewall. Your hosting provider may have a nice hardware solution in place, but if you have iptables or ipfw available, you can just keep block specific ip's using a tutorial like this...
http://www.e18.physik.tu-muenchen.de/~tnagel/ipt_recent/
Rather than go after them, having some sort of blacklist file/db feeding a software firewall would be the cheapest way to stay on top of stuff like that. Being able to run 'ban IP' at the shell or as a result of a script that monitors any brute force attacks (like hundreds of login attempts from a single ip within a given time range) usually works for most stuff.
I really despise these little hacker piss-ants. Its so nice to be on the software engineering side of things, rather than those chaos-inducing jerks. The good thing is, once you find a system that works for you for NMF, you'll be able to employ it for all of your other stuff.
Happy Hunting!
