I'm trying to figure out how to single out a whois record:

http://www.whois.net/whois_new.cgi?d=enter-net&tld=com

I've tried making sense of the following notice from whois, but so
farno luck.

To single out one record, look it up with "xxx", where xxx is one of
the of the records displayed above. If the records are the same, look
them up with "=xxx" to receive a full display for each record.

Doing a whois for "google.com" reveals a similar result:

http://www.whois.net/whois_new.cgi?d=google&tld=com

Whereas the following only returns one record:

http://www.whois.net/whois_new.cgi?d...hannel&tld=com

Can anyone explain how I single out just the ".com" domain?

On 8 Apr 2007, in the Usenet newsgroup comp.protocols.tcp-ip, in article
<1176056195.278088.228810@w1g2000hsg.googlegroups. com>, stilmark wrote:

>I'm trying to figure out how to single out a whois record:

>I've tried making sense of the following notice from whois, but so
>farno luck.
>
>To single out one record, look it up with "xxx", where xxx is one of
>the of the records displayed above. If the records are the same, look
>them up with "=xxx" to receive a full display for each record.

Do exactly what it says - precede the domain name with the equal sign.

>Doing a whois for "google.com" reveals a similar result:

[compton ~]$ whois google.com
[whois.internic.net]

Whois Server Version 1.3

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

GOOGLE.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
GOOGLE.COM.WORDT.DOOR.VEEL.WHTERS.GEBRUIKT.SERVERT JE.NET
GOOGLE.COM.VN
GOOGLE.COM.UA
GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
GOOGLE.COM.SPROSIUYANDEKSA.RU
GOOGLE.COM.SA
GOOGLE.COM.PLZ.GIVE.A.PR8.TO.AUDIOTRACKER.NET
GOOGLE.COM.MX
GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
GOOGLE.COM.IS.HOSTED.ON.PROFITHOSTING.NET
GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE .THAN.SECZY.COM
GOOGLE.COM.DO
GOOGLE.COM.BR
GOOGLE.COM.AU
GOOGLE.COM

[snip more useless crap]

Ah yes - internic trying to be ful.

[compton ~]$ whois =GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
[whois.internic.net]

Whois Server Version 1.3

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Server Name: GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
IP Address: 217.107.217.167
Registrar: ONLINENIC, INC.
Whois Server: whois.OnlineNIC.com
Referral URL: http://www.OnlineNIC.com

[snip more boiler plate]

Now the fact that RFC0952 didn't intend the 'dot' character to be used
as a part of the domain name has to be tempered with the fact that the
ISO-3166 domains really have a need for second level domains, and those
would be separated by dots. The dot used as a separator is also a
requirement in RFC1035. But clearly some registrars are ignoring
this concept in their quest for registration fees.

Old guy

In article <slrnf1l6se.uai.ibuprofin@compton.phx.az.us>,
ibuprofin@painkiller.example.tld (Moe Trin) wrote:

> On 8 Apr 2007, in the Usenet newsgroup comp.protocols.tcp-ip, in article
> <1176056195.278088.228810@w1g2000hsg.googlegroups. com>, stilmark wrote:
>
> >I'm trying to figure out how to single out a whois record:
>
> >I've tried making sense of the following notice from whois, but so
> >farno luck.
> >
> >To single out one record, look it up with "xxx", where xxx is one of
> >the of the records displayed above. If the records are the same, look
> >them up with "=xxx" to receive a full display for each record.
>
> Do exactly what it says - precede the domain name with the equal sign.
>
> >Doing a whois for "google.com" reveals a similar result:
>
> [compton ~]$ whois google.com
> [whois.internic.net]
>
> Whois Server Version 1.3
>
> Domain names in the .com and .net domains can now be registered
> with many different competing registrars. Go to http://www.internic.net
> for detailed information.
>
> GOOGLE.COM.ZZZZZ.GET.LAID.AT.WWW.SWINGINGCOMMUNITY.COM
> GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
> GOOGLE.COM.WORDT.DOOR.VEEL.WHTERS.GEBRUIKT.SERVERT JE.NET
> GOOGLE.COM.VN
> GOOGLE.COM.UA
> GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
> GOOGLE.COM.SPROSIUYANDEKSA.RU
> GOOGLE.COM.SA
> GOOGLE.COM.PLZ.GIVE.A.PR8.TO.AUDIOTRACKER.NET
> GOOGLE.COM.MX
> GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
> GOOGLE.COM.IS.HOSTED.ON.PROFITHOSTING.NET
> GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
> GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE .THAN.SECZY.COM
> GOOGLE.COM.DO
> GOOGLE.COM.BR
> GOOGLE.COM.AU
> GOOGLE.COM
>
> [snip more useless crap]
>
> Ah yes - internic trying to be ful.
>
> [compton ~]$ whois =GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM

Do you really need the "=" for that? That name isn't a prefix of any
other name, so it's already unambiguous.

> [whois.internic.net]
>
> Whois Server Version 1.3
>
> Domain names in the .com and .net domains can now be registered
> with many different competing registrars. Go to http://www.internic.net
> for detailed information.
>
> Server Name: GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM
> IP Address: 217.107.217.167
> Registrar: ONLINENIC, INC.
> Whois Server: whois.OnlineNIC.com
> Referral URL: http://www.OnlineNIC.com
>
> [snip more boiler plate]
>
> Now the fact that RFC0952 didn't intend the 'dot' character to be used
> as a part of the domain name has to be tempered with the fact that the
> ISO-3166 domains really have a need for second level domains, and those
> would be separated by dots. The dot used as a separator is also a
> requirement in RFC1035. But clearly some registrars are ignoring
> this concept in their quest for registration fees.

But how do you single out just the real GOOGLE.COM? "whois =google.com"
still displays all those matching names.

--
Barry Margolin, barmar@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***

On Mon, 09 Apr 2007, in the Usenet newsgroup comp.protocols.tcp-ip, in article
<barmar-4B9796.20412509042007@comcast.dca.giganews.com>, Barry Margolin wrote:

>ibuprofin@painkiller.example.tld (Moe Trin) wrote:

>> Ah yes - internic trying to be ful.
>>
>> [compton ~]$ whois =GOOGLE.COM.ZOMBIED.AND.HACKED.BY.WWW.WEB-HACK.COM

>Do you really need the "=" for that? That name isn't a prefix of any
>other name, so it's already unambiguous.

Actually, I use a script that detects the multiple answers response, and
re-runs the query automatically with the equal sign, and parses out the
correct whois server using some rather ugly scripting.

>But how do you single out just the real GOOGLE.COM? "whois =google.com"
>still displays all those matching names.

Aw, Barry - you don't _really_ want to see that kludge, do you?

FOO=$1
$BAR=`whois "=$FOO" | grep -i -A15 "$FOO$" | sed -n '/$FOO/,/Whois Server/p'`
REFERRER=`echo $BAR | grep 'Whois Server' | cut -d':' -f2`
if [ -n $REFERRER ] ; then
whois ${1}@${$REFERRER}
fi

because I'm usually interested in the actual whois data. So far, I don't
recall the script failing, possibly because this code doesn't get
triggered that often.

Old guy