Assessing the scope of the breach, sure. "Fixing" the breach by monitoring a single IP addresses access patterns not so much. The site needed to be taken down till a mitigation has been deployed.