1

Why is my WHOIS response not the same as when I check it on the website?

This is my code to check WHOIS for Google:

<?php
function checkDomain($domain_check,$server)
{
    // Open a socket connection to the whois server
    $con = fsockopen($server, 43);
    if (!$con) return false;

    // Send the requested doman name
    fputs($con, $domain_check."\r\n");

    // Read and store the server response
    $response = ' :';
    while(!feof($con)) 
    {
        $response .= fgets($con,128); 
    }

    echo $response;
    fclose($con);
}

sleep(5);
$domain_name = "google";
$tld = "com";
$server = "whois.verisign-grs.com";
checkDomain($domain_name.".".$tld,$server); 
?> 

And this is my response:

: Whois Server Version 2.0 Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. Aborting search 50 records found ..... GOOGLE.COM.ACKNOWLEDGES.NON-FREE.COM GOOGLE.COM.AFRICANBATS.ORG GOOGLE.COM.ANGRYPIRATES.COM GOOGLE.COM.AR GOOGLE.COM.AU GOOGLE.COM.BAISAD.COM GOOGLE.COM.BEYONDWHOIS.COM GOOGLE.COM.BR GOOGLE.COM.BUGBOUNTY.TEST.CIPRI.COM GOOGLE.COM.CN GOOGLE.COM.CO GOOGLE.COM.DEADKNIFERECORDS.COM GOOGLE.COM.DGJTEST028-PP-QM-STG.COM GOOGLE.COM.DIGNITYPRODUCT.COM GOOGLE.COM.DO GOOGLE.COM.EG GOOGLE.COM.FORSALE GOOGLE.COM.HACKED.BY.JAPTRON.ES GOOGLE.COM.HANNAHJESSICA.COM GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM GOOGLE.COM.HK GOOGLE.COM.HOUDA.DO.YOU.WANT.TO.MARRY.ME.JEN.RE GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET GOOGLE.COM.LASERPIPE.COM.DOMAINPENDINGDELETE.COM GOOGLE.COM.LOLOLOLOLOL.SHTHEAD.COM GOOGLE.COM.MAIKO.BE GOOGLE.COM.MX GOOGLE.COM.MY GOOGLE.COM.NOHAREKART.COM GOOGLE.COM.NS1.CHALESHGAR.COM GOOGLE.COM.NS2.CHALESHGAR.COM GOOGLE.COM.PE GOOGLE.COM.PK GOOGLE.COM.SA GOOGLE.COM.SG GOOGLE.COM.SHQIPERIA.COM GOOGLE.COM.SOUTHBEACHNEEDLEARTISTRY.COM GOOGLE.COM.SPAMMING.IS.UNETHICAL.PLEASE.STOP.THEM.HUAXUEERBAN.COM GOOGLE.COM.SPROSIUYANDEKSA.RU GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM GOOGLE.COM.TESTZZZZ.3000-RI.COM.DELETE-DNS.COM GOOGLE.COM.TR GOOGLE.COM.TW GOOGLE.COM.UA GOOGLE.COM.UK GOOGLE.COM.UY GOOGLE.COM.VABDAYOFF.COM GOOGLE.COM.VN GOOGLE.COM To single out one record, look it up with "xxx", where xxx is one of the records displayed above. If the records are the same, look them up with "=xxx" to receive a full display for each record. >>> Last update of whois database: Wed, 21 Dec 2016 12:49:46 GMT <<< For more information on Whois status codes, please visit https://icann.org/epp NOTICE: The expiration date displayed in this record is the date the registrar's sponsorship of the domain name registration in the registry is currently set to expire. This date does not necessarily reflect the expiration date of the domain name registrant's agreement with the sponsoring registrar. Users may consult the sponsoring registrar's Whois database to view the registrar's reported date of expiration for this registration. TERMS OF USE: You are not authorized to access or query our Whois database through the use of electronic processes that are high-volume and automated except as reasonably necessary to register domain names or modify existing registrations; the Data in VeriSign Global Registry Services' ("VeriSign") Whois database is provided by VeriSign for information purposes only, and to assist persons in obtaining information about or related to a domain name registration record. VeriSign does not guarantee its accuracy. By submitting a Whois query, you agree to abide by the following terms of use: You agree that you may use this Data only for lawful purposes and that under no circumstances will you use this Data to: (1) allow, enable, or otherwise support the transmission of mass unsolicited, commercial advertising or solicitations via e-mail, telephone, or facsimile; or (2) enable high volume, automated, electronic processes that apply to VeriSign (or its computer systems). The compilation, repackaging, dissemination or other use of this Data is expressly prohibited without the prior written consent of VeriSign. You agree not to use electronic processes that are automated and high-volume to access or query the Whois database except as reasonably necessary to register domain names or modify existing registrations. VeriSign reserves the right to restrict your access to the Whois database in its sole discretion to ensure operational stability. VeriSign may restrict or terminate your access to the Whois database for failure to abide by these terms of use. VeriSign reserves the right to modify these terms at any time. The Registry database contains ONLY .COM, .NET, .EDU domains and Registrars.

Then I checked WHOIS for Google https://www.whois.net.

The response from https://www.whois.net has Creation Date: 15-sep-1997.

The response from my code does not have Creation Date, how can I get it from my code?

Benjamin W.
  • 46,058
  • 19
  • 106
  • 116
  • 1
    They're actually sending "===google.com" for the lookup to single out the exact match, not just "google.com" – drew010 Dec 21 '16 at 15:50
  • @ drew010 --- we can use `===` on all domain name prefix ? – kalamung kalamong Dec 21 '16 at 16:29
  • That's some extension to whois that Verisign uses to perform an exact match and not these other weird records showing up in a result. Google's registrar MarkMonitor (whois.markmonitor.com) also appears to support it (or at least accepts it) but when I tried it on whois.tucows.com (OpenSRS) it didn't work. – drew010 Dec 21 '16 at 20:01
  • Also note that for the most accurate whois results, you need to map TLD's to root whois servers, and then know how to parse out referring servers and then issue another query to the referring server as the registry (e.g. Verisign) might not respond with the full information that the actual domain's registrar does have (like full contact info and changes). – drew010 Dec 21 '16 at 20:10
  • @ drew010 --- It's mean we have to use `===` on .com TLD only ? – kalamung kalamong Dec 22 '16 at 01:33
  • I think more specifically just with whois.verisign-grs.com if you want it to return all the whois data it has for the exact domain you're searching for. It looks like a single equal sign is also all that's necessary. `=google.com` – drew010 Dec 22 '16 at 05:51
  • A single = as prefix would be enough. It is mostly for .COM/.NET other gTLDs default on domain name and you need to prefix with `nameserver` if you want data about nameservers instead. – Patrick Mevzek Jan 02 '18 at 16:30

0 Answers0