If you don't know what jurisdiction they're in, or if they're even in the US, it'll be tough. The FBI and your local police would be my first steps. That said, it'll be tough to provide much actionable info beyond IP address unless you have a user verification process that leads to actual names and addresses.