1. The IP goes to [Quantil Networks][1]. [Quantil is the datacenter for UCWeb][2], the maker of UC Browser (the userganet used). This is very useful info. 2. There are ways to use Javascript to unmask a proxy user, but they are not foolproof. There are many questions here about how to do that. 3. An [online useragent parser][3] returns: UC Browser 10 on Android (KitKat) Samsung SM-G313HZ Useragents can easily be changed or spoofed, but this is what this useragent means, real or not. None of these things will prevent attacks in the future, but they do help you understand who sent *this* attack. [1]: http://quantilnetworks.com/ [2]: http://quantilnetworks.com/#customers [3]: https://developers.whatismybrowser.com/useragents/parse/#parse-useragent