This is the second part of a three part series covering how to handle potentially malicious URLs and IP addresses without getting burned by directly communicating with them. We'll cover various online resources and let you know which ones are our favorites and a little context around why we like them. In Part 1, Deobfuscating Potentially Malicious URLs, we laid the groundwork by covering policy, unshortening and deobfuscation. In Part 2 (Attributing Potentially Malicious URLs) we'll continue with WHOIS, GeoIP, and IP to URL.
Outline
WHOIS
Automatic Safe Deconstruction
GeoIP
IP to URL
Conclusion
read more............http://blog.opensecurityresearch.com/2013/01/attributing-potentially-malicious-urls.html