Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as "malicious". While a lot of time, this is truly bad, there are other times that websites share the same IP with a lot of others, therefore it gets flagged because of the host. A lot of this is occurring for in the cloud stuff as well. So with that being said, how do you truly determine if a site is bad or not? I currently use various website such as:
Robtex, ISC, Ipvoid, Urlvoid, MyWOT, McAfee Site Advisor, Virustotal, Anubis, various malware domain lists, etc.
But even then, data is sometimes questionable and inconsistent. Are there any additional websites and/or tools you all would recommend for further analysis. Maybe Cuckoo or some type of hardened Linux box where you can actually go to the website and search for redirects or be able to pull the various files from the site that your "infected machine" is trying to get. Any information would be appreciated!