What do you use to find....

jabberwock

the bad guy!!!

So in the new job I have to track down a website the odd time to get it shutdown. also have to track IPs aswell.

just wondering what sites/apps people use here to do anything like this?

have found a few good whois sites but am looking for a good whereis site. (if there is one)

any contribution welcome.

_CreeD_

http://cqcounter.com/whois/ maps the source for you visually aswell as the std. whois info.
Also the SANS Internet Storm Center can give you good advance warning on the major new exploit sites if they think they are relevant to ongoing malware attacks. http://isc.sans.org/

jabberwock

cheers for the reply _CreeD_

use the cqcounter whois quite regularly. nice and handy.

JohnnieM

http://www.ip-adress.com/ is the same thing really

What about this should also come in handy..

http://www.eeye.com/html/products/iris/index.html

_CreeD_

Just for internal tracking good old Snort can help for free (ethereal on the same box doesn't hurt), and of course the firewall logs (I like Adventnet's firewall analyzer to help make sense of them).

Stephen

I use www.dnsstuff.com a lot. Its gotten a bit bloaty and crap-laden in recent months though.