We have recently discovered that a third party has been using a bot to manipulate traffic on one of our websites. We have gathered enough information to determine that the traffic is indeed a bot, and not a real human.
We have our suspicions about who is behind the attack, but don't have any hard evidence. So my questions is, what are some things that can be done to determine who (the real life person or company) is behind the attack?
The information we have gathered so far are:
- The IP of the bot.
- User-agent string of the bot including the browser used
- The non-sensical browsing pattern of how the bot crawls our site.
Edit: Per the comments below I am not allowed to request that answers do not include anything illegal. Understandable as this is not a site for legal advice, nor could anyone be expected to know all the legal ins and outs of this situation. I'll open it up to all answers, but if you suggest torture or extortion your answer will be ignored :P