For the past days some script kiddie has been scanning our site with w3af and some basic manual checks. Although I know the site is "secure" because I analyze it almost everyday, I'm not perfect and some hole may be found.
I told my coordinator to block that IP, as he (the kid) is always attacking from the same IP, but my coordinator said that we can't do that because we don't know whether it's a static or dynamic IP, and he didn't want to prevent some legitimate user to access the site.
So what other alternative do we have to prevent the script kiddie to keep trying to find something? A WAF is not possible.