he is actually smart for me on exoria it was different, he tried to do bruteforce ssh attacks which cause denial of service for 5-15 seconds for the servers he could find its ip, i would say he isn't even skilled enough to trace what he is connecting to, he just checks domain, ip on otservlist...