Recently, I was working on some DNS tools, including DNS lookup and WHOIS tools. Needing to test the WHOIS tool, I used google.com as a test domain (as I usually do). The WHOIS lookup returned some rather interesting results:
Hostnames like "GOOGLE.COM.IS.HOSTED.ON.PROFITHOSTING.NET", "GOOGLE.COM.PLZ.GIVE.A.PR8.TO.AUDIOTRACKER.NET", GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.CO and " GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM" are listed.
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
**Server Name: GOOGLE.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
IP Address: 69.41.185.195
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com** ** Server Name: GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
IP Address: 217.107.217.167
Registrar: ONLINENIC, INC.
Whois Server: whois.35.com
Referral URL: http://www.OnlineNIC.com
Server Name: GOOGLE.COM.WORDT.DOOR.VEEL.WHTERS.GEBRUIKT.SERVERTJE.NET
IP Address: 62.41.27.144
Registrar: KEY-SYSTEMS GMBH
Whois Server: whois.rrpproxy.net
Referral URL: http://www.key-systems.net
Server Name: GOOGLE.COM.VN
Registrar: ONLINENIC, INC.
Whois Server: whois.35.com
Referral URL: http://www.OnlineNIC.com
Server Name: GOOGLE.COM.UA
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Server Name: GOOGLE.COM.TR
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Server Name: GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
IP Address: 80.190.192.24
Registrar: KEY-SYSTEMS GMBH
Whois Server: whois.rrpproxy.net
Referral URL: http://www.key-systems.net
Server Name: GOOGLE.COM.SPROSIUYANDEKSA.RU
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com
Server Name: GOOGLE.COM.SERVES.PR0N.FOR.ALLIYAH.NET
IP Address: 84.255.209.69
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: GOOGLE.COM.SA
Registrar: OMNIS NETWORK, LLC
Whois Server: whois.omnis.com
Referral URL: http://domains.omnis.com
Server Name: GOOGLE.COM.PLZ.GIVE.A.PR8.TO.AUDIOTRACKER.NET
IP Address: 213.251.184.30
Registrar: OVH
Whois Server: whois.ovh.com
Referral URL: http://www.ovh.com
Server Name: GOOGLE.COM.MX
Registrar: DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.PublicDomainRegistry.com
Server Name: GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
IP Address: 217.148.161.5
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.IS.HOSTED.ON.PROFITHOSTING.NET
IP Address: 66.49.213.213
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Server Name: GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
IP Address: 213.228.0.43
Registrar: GANDI SAS
Whois Server: whois.gandi.net
Referral URL: http://www.gandi.net
**** Server Name: GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM
IP Address: 209.187.114.130
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com**
Server Name: GOOGLE.COM.DO
Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Server Name: GOOGLE.COM.BR
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.BEYONDWHOIS.COM
IP Address: 203.36.226.2
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: GOOGLE.COM.AU
Registrar: PLANETDOMAIN PTY LTD.
Whois Server: whois.planetdomain.com
Referral URL: http://www.planetdomain.com
Domain Name: GOOGLE.COM
Registrar: MARKMONITOR INC.
Whois Server: whois.markmonitor.com
Referral URL: http://www.markmonitor.com
Name Server: NS1.GOOGLE.COM
Name Server: NS2.GOOGLE.COM
Name Server: NS3.GOOGLE.COM
Name Server: NS4.GOOGLE.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 10-apr-2006
Creation Date: 15-sep-1997
Expiration Date: 14-sep-2011
[other stuff omitted]
It looks like Google's not the only site with strange WHOIS information... Microsoft has some as well:
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Server Name: MICROSOFT.COM.ZZZZZZ.MORE.DETAILS.AT.WWW.BEYONDWHOIS.COM
IP Address: 203.36.226.2
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: MICROSOFT.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
IP Address: 69.41.185.194
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com
Server Name: MICROSOFT.COM.ZZZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
IP Address: 217.107.217.167
Registrar: ONLINENIC, INC.
Whois Server: whois.35.com
Referral URL: http://www.OnlineNIC.com
Server Name: MICROSOFT.COM.ZZZ.IS.0WNED.AND.HAX0RED.BY.SUB7.NET
IP Address: 207.44.240.96
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com
Server Name: MICROSOFT.COM.WILL.LIVE.FOREVER.BECOUSE.UNIXSUCKS.COM
IP Address: 185.3.4.7
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com
Server Name: MICROSOFT.COM.WILL.BE.SLAPPED.IN.THE.FACE.BY.MY.BLUE.VEINED.SPANNER.NET
IP Address: 216.127.80.46
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: MICROSOFT.COM.WILL.BE.BEATEN.WITH.MY.SPANNER.NET
IP Address: 216.127.80.46
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: MICROSOFT.COM.WAREZ.AT.TOPLIST.GULLI.COM
IP Address: 80.190.192.33
Registrar: KEY-SYSTEMS GMBH
Whois Server: whois.rrpproxy.net
Referral URL: http://www.key-systems.net
Server Name: MICROSOFT.COM.TOTALLY.SUCKS.S3U.NET
IP Address: 207.208.13.22
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: MICROSOFT.COM.STINKT.NACH.WIESBADEN.VISIT.CALITEC.NET
IP Address: 85.190.27.2
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: MICROSOFT.COM.SMELLS.SIMPLECODES.COM
IP Address: 207.44.234.34
Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Server Name: MICROSOFT.COM.SHOULD.GIVE.UP.BECAUSE.LINUXISGOD.COM
IP Address: 65.160.248.13
Registrar: GKG.NET, INC.
Whois Server: whois.gkg.net
Referral URL: http://www.gkg.net
Server Name: MICROSOFT.COM.RAWKZ.MUH.WERLD.MENTALFLOSS.CA
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: MICROSOFT.COM.OHMYGODITBURNS.COM
IP Address: 216.158.63.6
Registrar: DOTSTER, INC.
Whois Server: whois.dotster.com
Referral URL: http://www.dotster.com
Server Name: MICROSOFT.COM.MORE.INFO.AT.WWW.BEYONDWHOIS.COM
IP Address: 203.36.226.2
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: MICROSOFT.COM.LOVES.ME.KOSMAL.NET
IP Address: 65.75.198.123
Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Server Name: MICROSOFT.COM.LIVES.AT.SHAUNEWING.COM
IP Address: 216.40.250.172
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: MICROSOFT.COM.IS.NOT.YEPPA.ORG
Registrar: OVH
Whois Server: whois.ovh.com
Referral URL: http://www.ovh.com
Server Name: MICROSOFT.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
IP Address: 217.148.161.5
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: MICROSOFT.COM.IS.NOT.AS.COOL.AS.SIMPLECODES.COM
IP Address: 207.44.234.232
Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Server Name: MICROSOFT.COM.IS.IN.BED.WITH.CURTYV.COM
IP Address: 216.55.187.193
Registrar: ABACUS AMERICA, INC. DBA NAMES4EVER
Whois Server: whois.names4ever.com
Referral URL: http://www.names4ever.com
Server Name: MICROSOFT.COM.IS.HOSTED.ON.PROFITHOSTING.NET
IP Address: 66.49.213.213
Registrar: COMPUTER SERVICES LANGENBACH GMBH DBA JOKER.COM
Whois Server: whois.joker.com
Referral URL: http://www.joker.com
Server Name: MICROSOFT.COM.IS.GOD.BECOUSE.UNIXSUCKS.COM
IP Address: 161.16.56.24
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com
Server Name: MICROSOFT.COM.IS.A.STEAMING.HEAP.OF.FUCKING-BULLSHIT.NET
IP Address: 63.99.165.11
Registrar: THE NAME IT CORPORATION DBA NAMESERVICES.NET
Whois Server: whois.aitdomains.com
Referral URL: http://www.aitdomains.com
Server Name: MICROSOFT.COM.IS.A.MESS.TIMPORTER.CO.UK
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com
Server Name: MICROSOFT.COM.HOSTED.BY.CALITEC.NET
IP Address: 85.190.27.3
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: MICROSOFT.COM.HAS.ITS.OWN.CRACKLAB.COM
IP Address: 209.26.95.44
Registrar: DOTSTER, INC.
Whois Server: whois.dotster.com
Referral URL: http://www.dotster.com
Server Name: MICROSOFT.COM.HAS.A.PRESENT.COMING.FROM.HUGHESMISSILES.COM
IP Address: 66.154.11.27
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: MICROSOFT.COM.GOT.OWNED.BY.CALITEC.NET
IP Address: 85.190.27.2
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: MICROSOFT.COM.FILLS.ME.WITH.BELLIGERENCE.NET
IP Address: 130.58.82.232
Registrar: CRONON AG BERLIN, NIEDERLASSUNG REGENSBURG
Whois Server: whois.tmagnic.net
Referral URL: http://nsi-robo.tmag.de
Server Name: MICROSOFT.COM.DRINKS.LISTERINE.NET
IP Address: 66.33.206.206
Registrar: SPOT DOMAIN LLC DBA DOMAINSITE.COM
Whois Server: whois.domainsite.com
Referral URL: http://www.domainsite.com
Server Name: MICROSOFT.COM.CAN.GO.FUCK.ITSELF.AT.SECZY.COM
IP Address: 209.187.114.147
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com
Server Name: MICROSOFT.COM.ARE.GODDAMN.PIGFUCKERS.NET.NS-NOT-IN-SERVICE.COM
IP Address: 216.127.80.46
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Server Name: MICROSOFT.COM.AND.MINDSUCK.BOTH.SUCK.HUGE.ONES.AT.EXEGETE.NET
IP Address: 63.241.136.53
Registrar: DOTSTER, INC.
Whois Server: whois.dotster.com
Referral URL: http://www.dotster.com
Domain Name: MICROSOFT.COM
Registrar: TUCOWS INC.
Whois Server: whois.tucows.com
Referral URL: http://domainhelp.opensrs.net
Name Server: NS1.MSFT.NET
Name Server: NS2.MSFT.NET
Name Server: NS3.MSFT.NET
Name Server: NS4.MSFT.NET
Name Server: NS5.MSFT.NET
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 10-oct-2006
Creation Date: 02-may-1991
Expiration Date: 03-may-2014
Anyone know how this was done?
Comments
welp, those WHOIS replies are actually not for the google.com or microsoft.com domains. if, for example, you look closely at MICROSOFT.COM.AND.MINDSUCK.BOTH.SUCK.HUGE.ONES.AT.EXEGETE.NET you notice the domain is EXEGETE.NET, with the rest being just so called "subdomains" to this domain.
It's just that the WHOIS server does a wildcard query and returns all matches (the example result I posted contains the string "MICROSOFT.COM" and thus gets included in the WHOIS server's reply.