[RobPomeroy]

You should be able to apply behavioural detection here even if the IP address changes - they'd have to be polling your site regularly. Is there a discernible pattern in the logs?