I need to identify the domain that sent viruses to me. The only information that I have is the IP address, and of course the from address in the email is almost always spoofed. Network-tools.com used to have an express lookup that worked. Now, all I can find are sites that will tell me who the ISP is that owns the IP address, not the mail server or the domain that the IP address is assigned to. I need this information to make sure that I do not block IP addresses that would be sending legitimate email, and so that I can contact the appropriate IT people from where the viruses came from.