1

I was testing the access to the Internic WHOIS with the following code:

$domains = array('google.com');
$internic = fsockopen('whois.internic.net', 43);

if (is_resource($internic) === true)
{
    foreach ($domains as $domain)
    {
        fwrite($internic, $domain . "\r\n");
        socket_set_timeout($internic, 30);

        while (feof($internic) !== true)
        {
            ph()->Dump(fread($internic, 4096));
        }
    }

    fclose($internic);
}

Surprisingly, this was the output I got:

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

GOOGLE.COM.ZZZZZZZZZZZZZ.GET.ONE.MILLION.DOLLARS.AT.WWW.UNIMUNDI.COM
GOOGLE.COM.ZZZZZZ.THE.BEST.WEBHOSTING.AT.WWW.FATUCH.COM
GOOGLE.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
GOOGLE.COM.ZNAET.PRODOMEN.COM
GOOGLE.COM.YUCEKIRBAC.COM
GOOGLE.COM.YUCEHOCA.COM
GOOGLE.COM.WORDT.DOOR.VEEL.WHTERS.GEBRUIKT.SERVERTJE.NET
GOOGLE.COM.VN
GOOGLE.COM.UY
GOOGLE.COM.UA
GOOGLE.COM.TW
GOOGLE.COM.TR
GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
GOOGLE.COM.SPROSIUYANDEKSA.RU
GOOGLE.COM.SERVES.PR0N.FOR.ALLIYAH.NET
GOOGLE.COM.SANATATEA-NOASTRA.COM
GOOGLE.COM.SA
GOOGLE.COM.PE
GOOGLE.COM.P2NK-AJA.COM
GOOGLE.COM.MX
GOOGLE.COM.LASERPIPE.COM
GOOGLE.COM.IS.SHIT.SQUAREBOARDS.COM
GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
GOOGLE.COM.IS.HOSTED.ON.PROFITHOSTING.NET
GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
GOOGLE.COM.HICHINA.COM
GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM
GOOGLE.COM.ESJUEGOS.NET
GOOGLE.COM.DO
GOOGLE.COM.CO
GOOGLE.COM.CN
GOOGLE.COM.BR
GOOGLE.COM.BEYONDWHOIS.COM
GOOGLE.COM.AU
GOOGLE.COM.AR
GOOGLE.COM.AFRICANBATS.ORG
GOOGLE.COM

To single out one record, look it up with "xxx", where xxx is one of the
of the records displayed above. If the records are the same, look them up
with "=xxx" to receive a full display for each record.

>>> Last update of whois database: Sat, 11 Dec 2010 04:45:42 UTC <<<

Does anyone know why I'm getting this strange response?

1 Answer 1

2

prepend an equals sign for an exact match, otherwise you'll get anything that starts with google.com. see http://allmybrain.com/2007/10/10/programming-a-client-for-the-whois-protocol/, about halfway down the page.

turns out this is isn't true on this particular server, the "=" instead means to show the full record for all matches (as, on re-reading, the info message says). instead use the "domain" keyword, as in: "domain google.com".

jcomeau@intrepid:~/rentacoder/jlw14/est$ telnet whois.internic.net 43
Trying 199.7.55.74...
Connected to whois.internic.net.
Escape character is '^]'.
domain google.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

   Domain Name: GOOGLE.COM
   Registrar: MARKMONITOR INC.
   Whois Server: whois.markmonitor.com
   Referral URL: http://www.markmonitor.com
   Name Server: NS1.GOOGLE.COM
   Name Server: NS2.GOOGLE.COM
   Name Server: NS3.GOOGLE.COM
   Name Server: NS4.GOOGLE.COM
   Status: clientDeleteProhibited
   Status: clientTransferProhibited
   Status: clientUpdateProhibited
   Status: serverDeleteProhibited
   Status: serverTransferProhibited
   Status: serverUpdateProhibited
   Updated Date: 15-sep-2010
   Creation Date: 15-sep-1997
   Expiration Date: 14-sep-2011

>>> Last update of whois database: Sat, 11 Dec 2010 05:28:12 UTC <<<

NOTICE: The expiration date displayed in this record is the date the 
registrar's sponsorship of the domain name registration in the registry is 
currently set to expire. This date does not necessarily reflect the expiration 
date of the domain name registrant's agreement with the sponsoring 
registrar.  Users may consult the sponsoring registrar's Whois database to 
view the registrar's reported date of expiration for this registration.
[yadda yadda...]
3
  • Tried that but I still get a similar output.
    – Alix Axel
    Dec 11, 2010 at 5:10
  • hmm, me too. will check on that. Dec 11, 2010 at 5:20
  • 2
    entering "help" shows keywords you can use, one of which is "domain", so entering "domain google.com" gets you the one record. does this help? it also shows that the "=" means something completely different from what the original "informative" message says. Dec 11, 2010 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.