I think now is very simple to find him. Just contact cloud service company and ask them whois behind that node. The only question is if that ip is from scammer or from a regular node that do just the transactions. someone with more technical knowledge can answer this.