Last week I had to deal with the following situation: some of my users complained that they got emails telling them that their computers are infected and they should go to a certain site for a free scan. Further investigation revealed that the site in question is a typical malware spreading site: it displays a fake scan window and tricks the inexperienced users into downloading a trojan.
By pinging the domain, I've got the IP address of that site. A whois on that IP revealed to me the hosting company that hosted the malware site. I've emailed their abuse team pointing them at that site. They choosed to ignore my email and the malware site is still up and running ATM.
Of course I'm upset by such attitude. I'd like to hear from you how you deal with such situations. I'd also like you to comment my strategy.
My users access the Internet over a proxy server. That malware site is blocked now. But I want to go one step further. I want to find out all sites that hosting company is hosting and block them. Can you suggest a workflow and tools for performing this research?