Default WHOIS server in FreeBSD

P

ph0enix

What's the default WHOIS server that gets queried when running the whois command? I'm getting rather "interesting" results (profanity) when doing:

Code: 
whois microsoft.com

I tried the same command on an Ubuntu system and it works fine. I'm guessing Ubuntu uses a different WHOIS server.

Thanks!
 
Code: 
man whois
-h host
Use the specified host instead of the default variant. Either a
host name or an IP address may be specified.

By default whois constructs the name of a whois server to use
from the top-level domain (TLD) of the supplied (single) argu-
ment, and appending ".whois-servers.net". This effectively
allows a suitable whois server to be selected automatically for a
large number of TLDs.
Click to expand...
 
The OP should probably check his nameservers - both /etc/resolv.conf and his router's settings.
 
Have you tried doing a whois lookup for a domain such as microsoft.com on one of your machines?
I get the same and it's been a known but harmless issue as long as I can remember.

Code: 
# whois microsoft.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

MICROSOFT.COM.ARE.GODDAMN.PIG[...].NET.NS-NOT-IN-SERVICE.COM
MICROSOFT.COM.CAN.GO.[...].ITSELF.AT.SECZY.COM
MICROSOFT.COM.DEADKNIFERECORDS.COM
MICROSOFT.COM.FILLS.ME.WITH.BELLIGERENCE.NET
... continued ...
 
usdmatt said:
Have you tried doing a whois lookup for a domain such as microsoft.com on one of your machines?
I get the same and it's been a known but harmless issue as long as I can remember.
Click to expand...

Frankly, I don't believe that Microsoft put that there. I just did that same lookup again in case I missed the actual wording before. And no, I get the real thing. However, I'm fussy about which nameservers I use. I really don't like any mitm attacks.

Edit: I seems this is not actually DNS related (sorry) but rather from bad whois lookup choices, presumably locally. But doing some more searching on this it sounds like some of the whois services have also had bad data on occasion. Apparently the problem is easy to replicate, but a properly configured whois lookup should not do this. Here's a related thread.
 
Microsoft didn't put it there, just idiots registering ns entries with their domain provider.

Interesting that some people don't see it. I'm pretty sure it's always been the same from here and I have no interest in configuring whois servers manually. My machines are just using the default com.whois-servers.net, which points to whois.verisign-grs.com/199.7.54.74 for me.
 
I guess I'm ignorant about how WHOIS queries work. I thought they used authoritative servers - similar to how DNS works.
I don't see how idiots registering ns entries with their registrar would cause the problem. You can't add authoritative NS servers for any other domain but your own with the registrars.
 
ph0enix Apparently some WHOIS servers query in a manner that shows related domains. I'm not sure what they hope to gain by showing the information that way though.
 
You must log in or register to reply here.
Back
Top