phillips321.co.uk

Figured I’d keep a copy of this on here for the next time I need to do malware investigation.

• urlvoid.com – checks URL’s against lots of blacklists, emergingthreats, malwaredomainlist and zeustracker/etc…
• ipvoid.com – Same as above but for IP addresses
• support.clean-mx.de – Searches above databases and records logs of abuse claims. Useful as it can sometime give you extra URI’s for a host to comb your logs for. Also usefully gives you the date that its crawler last was able to pull down the malicious binary.
• hphosts.com – Provides an assessment according to the type of nastiness a domain or IP is associated with.
• malwaredomains.com – Provides a blacklist DNS entry head to the downloads page, open the text file version and CTRL-F to search. Will give reason for blocking (i.e. listed in emergingthreats.net) along with the date.
• malwaredomainlist.com – Provides a listing of hosts and ip’s known to be associated with malware.
• emergingthreats.net – Provides snort rules configured to detect malicious traffic/hosts.
• robtex.com – Advanced DNS lookups, links hosts to nameservers, can give aliases and associated subdomains as well as any shared hosts.
• network-tools.com – Basic network tools, whois, dns, traceroute, etc… useful for performing checks NOT from your own ip
• zeustracker.com – lists zeus C&C nodes
• spyeyetracker.com – lists spyeye C&C nodes

Be careful if you use any of these tools on the affected network as often it will contain the hostname or IP you’re looking for in the request parameters which means they’ll flag you up as an infected laptop without looking at the actual URL you’re browsing to (happened to me previously).