IP Address Locator
By far the best and most accurate geolocating service - will tell you where the IP address is located geographically, what time zone it is located in and whether or not it is a proxy.
Mass Country of Origin Lookup
Great tool for checking the sources of a DDoS attack - will take a list of IP addresses, one per line and return the IP, domain, location, ISP and ASN for each.
MAC Address Lookup
Utility for searching the IEEE MAC address assignment database - quick way to identify what type of device is located at the MAC address in question.
What's My IP
As the name implies, shows you what your public IP address (and its geolocation) is.
WolframAlpha Subnet Calculator
Very flexible IP subnet calculator, lets you calculate IP address ranges based on number of addresses needed, subnet mask bits or numeric subnet masks.
TechZoom IP Calculator
Another handy multi-purpose IP address calculator, has ability to calculate subnets and convert IP address masks into individual address lists. Also includes IP and domain name checkers.
Robtex DNS Lookup
Extremely comprehensive "DNS Lookup" site that goes way beyond just DNS lookups. Can be used to lookup BGP routing and AS information for IP addresses, for example.
Amazingly detailed DNS information reporter and status analyzer. Will show a slew of details about a specified domain name, including but not limited to NS, SOA, MX and WWW records, reverse records, duplicate records, et cetera, and warn you of any configuration that does not follow the best practices.
Great tool for finding other hosts/servers on the subnet of the domain name in question. The only drawback is that it does not offer a reverse lookup option (enter the IP address range, get the domain names of all the servers), but this can be partially remediated by doing a reverse search in cached Google results: http://www.google.com/#hl=en&q=site%3Adnsdigger.com+126.96.36.199
Similar to DNSDigger, another great tool for looking up domain names for the IP addresses that may show up in your IPS logs. Again, you can leverage Google's cache if needed: http://www.google.com/search?&q=188.8.131.52+site%3Aurlquery.net Note: this site can be reported as malicious by reputation services such as WOT, perhaps due to links to malicious domain information contained within. Proceed with caution.
ViewDNS IP/DNS Toolkit
Handy multi-tool website that can perform a variety of tasks, such as looking up WhoIs information, DNS resolution, host traceroute, etc.
Similar toolset to the one above, but with a much wider range of tools. Kind of like a Swiss-army knife of IP an DNS address tools.
Email Header Analyzer
Convenient tool to quickly analyze email headers. Breaks down all the flags into a convenient, easy to read table and calculates delivery delays (with graph) for each hop. Has a link on the bottom to "forget" the header details when you're done with them.
Web Of Trust
"Crowd-sourced" web reputation service which works by letting its users rank sites they visit in four categories. May contain false positives but is most likely to have ratings for more obscure sites.
Great tool for checking web reputation of a specific domain name. TrustedSource databases are used by McAfee GTI and many spam filtering vendors, so if your emails stop getting to their destination - good place to check whether your SMTP server has been blacklisted. Will also show any recent increases in outgoing email activity, so it could be handing for spotting first signs of infection.
McAfee Website Reputation Database
Another site by McAfee, which complements the TrustedSource IP and domain name reputation database. Will show any harmful files and behaviours (such as exposed user email addresses, etc), linked websites and annoyances, along with user-contributed feedback (useful for identifying spammer or phishing websites).
Norton Safe Web
Similar to McAfee Site Advisor but will contain specific malware names and locations.
BlueCoat WebPulse Site Checker
This one isn't extremely useful as it does not provide much detail, but can be used to verify how BlueCoat categorizes a specific site in their database. This database is also used across all BlueCoat proxy and web-content filtering appliances.
VirusTotal URL Checker
The popular multi-antivirus online file scanner, now owned by Google, has added the ability to scan provided URLs against over 50 different URL reputation services. Has ability for users to rank the URL "maliciousness" and provide comments. Great resources for quickly gauging if an address is safe.You can also use their "Search" tab to view Passive DNS history collected in previous lookups of the domain.
Crowdsourced searchable database of active and historical threats for IP addresses and domain names. A bit annoying in that on the first check, it asks you to receive and click an email link.
RiskIQ Community (formerly PassiveTotal)
Not to be confused with VirusTotal, PassiveTotal (which has now been acquired by RiskIQ) is a fantastic tool for searching current and historical information on IP addresses and domain names. The free community tier does give you a limited number of lookups per day, but this tool is fantastic for looking up historical WhoIs records, passive DNS records, current DNS records, and other available information.
Another great open PassiveDNS repository. No registration required.
Crowdsourced "host file" - community built database of IP address and domain name resolutions and reputations. Can be really, really slow to load for the first time, don't give up.
Port Information Lookup
Invaluable tool for port information lookup, powered by the voluntary contributions to the SANS ISC log database. Will show both legitimate and malicious services (backdoors, trojans) that most often use the port, any CVEs associated with it, as well as any recent statistical increase in port activity worldwide. A must have in the arsenal of any network forensic investigator.
SpeedGuide Port Information Lookup
Another excellent port information look-up tool. Does not have the same trending details as the one above, but often has a lot more details about the possible applications utilizing the port, including user-contributed comments.
Open Port Check Tool
Quick and easy utility for checking whether a port is open on the public IP address you're coming from. Will also show you your public IP address, so it can be used instead of the above tool.
"Search engine for the internet of things". Basically a huge online database of worldwide Nmap scan results. Lets you search for IP address, ranges, organizations, ports or keywords and returns anything that matches and could be seen connected to the public internet in the past few weeks.
Basically the same thing as Shodan, but also shows a pretty map. In my experience the results are not nearly as complete as Shodan.
Another Shodan alternative.
A very extensive repository of Windows security log event IDs, failure codes and fields.
Event ID Information
A searchable event ID database, containing event ID descriptions from various sources and applications.
Avaya/Nortel Trace Analyzer
Shows the Nortel Passport (Avaya ERS) 8600/8800 trace file as a sortable table, helps to determine what is causing high CPU load and allows you to see a sortable table of MAC addresses, IP addresses and Ports.
Perhaps the most well-known multi-antivirus online scanning tool, now owned by Google and offering even a desktop-client for right-click uploading of suspicious files. Scans the files with dozens of various antivirus clients and has a user-contributed rating and comments system.
Very similar to VirusTotal, with fewer antivirus engines but allows for a larger file size. Does not have the same community feedback mechanisms, but handy for double-checking VirusTotal or those cases where you need to scan a file just bigger than its 64Mb limit.
Payload Security Hybrid Analysis
Free malware analysis service powered by the VxStream Sandbox, which can be used to detonate executables, Office, PDF and APK files up to 180 Mb in size in a sandbox environment.
This isn't exactly a malware analysis sandbox, but it does offer the capability to open a website in a virtual browser. Very handy when a lab environment isn't available and you need to check what a suspicious URL looks like when opened.
Online encyclopedia of malware families.
Sucuri Site Check
Quick scanner for known website vulnerabilities and embedded malware. Will try to sell you the Sucuri WAF every time you run it, but can be handy in identifying/confirming site compromises and seeing exactly where the injected code is.
Malware Domain List
Searchable database of known malware/C&C domains and IP addresses.
A proverbial swiss army knife of parsing, decoding and converting just about anything you can think of.
Website Status Checker
If you run into a website that will not load from your network, and you're wondering if it's something to be concerned about or the website is really down for everyone - the above site is a very quick and easy way to verify that.
Website Redirect Tracer
Most malicious spam/phishing campaigns nowadays use multiple redirects between the link included in the email, and the final payload page. This will trace and show you all the redirect URLs, without opening the final malicious destination.
Hex to ASCII to HEX Converter
Very simple and easy to use HEX to ASCII and ASCII to HEX converter.
Great tools for composing and testing Regular Expressions (RegEx).