From brokenpoet.org wiki

This will simply look through the domlogs for an IP and let you know which sites it has accessed:

grep -lr '1.2.3.4' /usr/local/apache/domlogs/*/* | cut -d'/' -f7