if that IP is real... he lives here
http://www.ip2state.com/map.asp?s=ip...&ses=911115812
Lima, Peru and is using an IP administerd by LACNIC (Latin American Names Registry) .. A complaint lodged there with a copy to ICAN probably wouldnt hurt.
http://lacnic.net/en/
Whois.sc says that IP is handled by
source=dns3.unired.net.pe.; responsible person=hostmaster@unired.net.pe.
http://whois.sc/200.48.218.179
http://www.unired.net.pe/ looks like its part of a proper telco in peru, so a complaint to them should help or might at least get some confirmation if they think the hacker is really with them or just using a victims machine or whatever deal is.
If it's a real IP and this person is in industry, chances are they have submitted sites to you to in past if only to test system.. worth a look if you log IPs I'd say.
thanks for explanation on the iframe insert TP/Alex ... that sounds less of a problem than i thought at first. can someone please PM me the script name affected?