Whois google.com

[benthehutt]

So, when I was fooling around today, I used the whois command to see if my network connection was running smooth.  So I typed in "whois google.com" and the following popped up:

Code Select Expand

  Server Name: GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
   IP Address: 80.190.192.24
   Registrar: KEY-SYSTEMS GMBH
   Whois Server: whois.rrpproxy.net
   Referral URL: http://www.key-systems.net

   Server Name: GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
   IP Address: 217.148.161.5
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com

   Server Name: GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
   IP Address: 213.228.0.43
   Registrar: GANDI
   Whois Server: whois.gandi.net
   Referral URL: http://www.gandi.net

   Server Name: GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM
   IP Address: 209.187.114.130
   Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
   Whois Server: whois.itsyourdomain.com
   Referral URL: http://www.itsyourdomain.com

   Server Name: GOOGLE.COM.BR
   Registrar: ENOM, INC.
   Whois Server: whois.enom.com
   Referral URL: http://www.enom.com

   Server Name: GOOGLE.COM.AU
   Registrar: PRIMUS TELCO PTY LTD DBA PRIMUSDOMAIN/PLANETDOMAIN
   Whois Server: whois.planetdomain.com
   Referral URL: http://www.planetdomain.com

What happened?  Did something get hacked or is it just my computer on the fritz?

[Metgod]

I'm really not here, but I'd thought I'd answer this in your mind (so don't be too surprised if I do not participate in general for a while).

Check the code:

#ifdef HAVE_REGEXEC
#include <regex.h>
#endif

and probably other things.

Need I say more ?

I think I explained this on another post before, but who knows for sure ...

[benthehutt]

Yes, you do need to say more...  

Also, I used Ajax (http://esspea.com/scripts/ajaxwhois/index.php as an example) and it reports fine.  Does whois not directly query internic?

[Metgod]

okay ... fine! I'll say some more!

It 'matched' your string; you typed in 'google.com' and since all those hostnames have 'google.com' in their name, the program matched and thus printed them. I'd guess the reason the other ones worked is because it's coded different, but the whois on linux (and probably other unixes) does it the way you see. You could of course try various options to disable that, but I didn't really investigate it much (and I rarely use that command). But try microsoft.com as well. Or www.google.com instead (you might find different matches).

Does that explain it ? *goes back to his slumber, although fearing it'll be short*

[benthehutt]

You can keep sleeping, I get it...  It seems to me like a Linux bug though, not a small mistake.

[Uneek]

You have to remember that all of those are sub-domains of other domains, not of google.com's domain... i.e. GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM is part of the gulli.com domain... has nothing to do with google... but since they contain google in the full sub-domain name it came up in your search.

[Metgod]

Yup... definitely a good point.

Sorry Ben, I actually forgot about your original post, and the comment about the bug versus feature.

I think it's not a bug so much as a feature: I'm fairly sure it was deliberate. It does seem a bit odd to scan instead of do a exact search, but it's how it was intended I think. Would be interesting to know the reason behind it though....

[Cobra]

Yeah .. if you do a search for just MICROSOFT.COM .. you will get the same type of results.. or at least you used to ..