whoisコマンドでdns spamの結果を拾わないようにする

whoisコマンドが正しい情報を返してくれないで、ノイズのある結果が得られるなと思って調べたら、
ただしくwhoisを理解していないだけでした。

1
whois help

でわかる話ではありますが、whois spamの話です。

whois helpでみると

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
whois help
...
<KEYWORD overview>
WHOIS keywords fall into categories: those that specify the TYPE of
records to search, those that modify the interpretation of the input or
tell the type of output to produce, and those that are commands such as
HELP or QUIT.
The following keywords restrict a search to a certain TYPE of field in the
database:
domain
Finds a domain record. Find out domain name, registrar name,
whois server and URL, Nameserver name and IP Addresses, and updated
date. For example, "domain netsol.com".
nameserver
Finds nameserver records. Find out nameserver name, registrar name,
IP addresses, Whois Server name and URL. For example,
'nameserver DNS.SPRINTLINK.COM' or 'nameserver 101.198.1.101'.
registrar
Finds records for "registrar". Find out Registrar name, mail
address, phone number and contact information. For example,
'registrar Network Solutions, Inc.'
...

とあるように whois domain でコマンドを実行すると、取得できるドメイン名、レジストラ名、ネームサーバーなどの文字列からドメイン名を検索する。

ということで意図しない結果を返すことがある。

たとえば、 google.com の場合

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
whois google.com
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
GOOGLE.COM.ACKNOWLEDGES.NON-FREE.COM.NAMESILO.COM
GOOGLE.COM.AFRICANBATS.ORG
GOOGLE.COM.ANGRYPIRATES.COM
GOOGLE.COM.AR
GOOGLE.COM.AU
GOOGLE.COM.BAISAD.COM
GOOGLE.COM.BD
GOOGLE.COM.BEYONDWHOIS.COM
GOOGLE.COM.BR
GOOGLE.COM.BUGBOUNTY.TEST.AT.CIPRI.COM
GOOGLE.COM.CN
GOOGLE.COM.CO
GOOGLE.COM.DEADKNIFERECORDS.COM
GOOGLE.COM.DGJTEST028-PP-QM-STG.COM
GOOGLE.COM.DO
GOOGLE.COM.EG
GOOGLE.COM.FORSALE
GOOGLE.COM.HACKED.BY.JAPTRON.ES
GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM
GOOGLE.COM.HK
GOOGLE.COM.HOUDA.DO.YOU.WANT.TO.MARRY.ME.JEN.RE
GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
GOOGLE.COM.LASERPIPE.COM.DOMAINPENDINGDELETE.COM
GOOGLE.COM.LOLOLOLOLOL.SHTHEAD.COM
GOOGLE.COM.MAIKO.BE
GOOGLE.COM.MX
GOOGLE.COM.MY
GOOGLE.COM.NS1.CHALESHGAR.COM
GOOGLE.COM.NS2.CHALESHGAR.COM
GOOGLE.COM.PE
GOOGLE.COM.PK
GOOGLE.COM.SA
GOOGLE.COM.SG
GOOGLE.COM.SHQIPERIA.COM
GOOGLE.COM.SOUTHBEACHNEEDLEARTISTRY.COM
GOOGLE.COM.SPAMMING.IS.UNETHICAL.PLEASE.STOP.THEM.HUAXUEERBAN.COM
GOOGLE.COM.SPROSIUYANDEKSA.RU
GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
GOOGLE.COM.TESTZZZZ.3000-RI.COM.DELETE-DNS.COM
GOOGLE.COM.TR
GOOGLE.COM.TW
GOOGLE.COM.UA
GOOGLE.COM.UK
GOOGLE.COM.UY
GOOGLE.COM.VABDAYOFF.COM
GOOGLE.COM.VN
GOOGLE.COM.YUCEHOCA.COM
GOOGLE.COM.ZNAET.PRODOMEN.COM
GOOGLE.COM
...

と全く見当違いのホストも帰ってくる。
ということで、helpにあるようにキーワードでクエリを絞り込む必要があるらしい。

ドメインのレコードだけを検索する場合は

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
whois 'domain google.com'
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Domain Name: GOOGLE.COM
Registrar: MARKMONITOR INC.
Sponsoring Registrar IANA ID: 292
Whois Server: whois.markmonitor.com
Referral URL: http://www.markmonitor.com
Name Server: NS1.GOOGLE.COM
Name Server: NS2.GOOGLE.COM
Name Server: NS3.GOOGLE.COM
Name Server: NS4.GOOGLE.COM
Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
Updated Date: 20-jul-2011
Creation Date: 15-sep-1997
Expiration Date: 14-sep-2020
>>> Last update of whois database: 2017-07-23T02:10:56Z <<<
...

と意図した結果を取得できる。

フィールドは domain, nameserver, registrarで絞り込むことができる。

ちなみに、google.comで全てのフィールドを検索した際に返される結果はshortタイプのため詳細を出したいのであれば = をつけるといい。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
whois =google.com
Whois Server Version 2.0
Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Server Name: GOOGLE.COM.ACKNOWLEDGES.NON-FREE.COM.NAMESILO.COM
IP Address: 1.1.1.1
Registrar: NAMESILO, LLC
Whois Server: whois.namesilo.com
Referral URL: http://www.namesilo.com
Server Name: GOOGLE.COM.AFRICANBATS.ORG
Registrar: TUCOWS DOMAINS INC.
Whois Server: whois.tucows.com
Referral URL: http://www.tucowsdomains.com
Server Name: GOOGLE.COM.ANGRYPIRATES.COM
IP Address: 8.8.8.8
Registrar: NAME.COM, INC.
Whois Server: whois.name.com
Referral URL: http://www.name.com
Server Name: GOOGLE.COM.AR
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.AU
Registrar: PLANETDOMAIN PTY LTD.
Whois Server: whois.planetdomain.com
Referral URL: http://www.planetdomain.com
Server Name: GOOGLE.COM.BAISAD.COM
IP Address: 91.218.229.20
IP Address: 92.53.96.24
Registrar: REGISTRAR OF DOMAIN NAMES REG.RU LLC
Whois Server: whois.reg.com
Referral URL: http://www.reg.ru
Server Name: GOOGLE.COM.BD
Registrar: LIQUIDNET LTD.
Whois Server: whois.liquidnetlimited.com
Referral URL: http://www.liquidnetlimited.com
Server Name: GOOGLE.COM.BEYONDWHOIS.COM
IP Address: 203.36.226.2
Registrar: INSTRA CORPORATION PTY, LTD.
Whois Server: whois.instra.net
Referral URL: http://www.instra.com
Server Name: GOOGLE.COM.BR
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.BUGBOUNTY.TEST.AT.CIPRI.COM
IP Address: 8.8.4.4
IP Address: 8.8.8.8
IP Address: 80.69.82.4
Registrar: KEY-SYSTEMS GMBH
Whois Server: whois.rrpproxy.net
Referral URL: http://www.key-systems.net
Server Name: GOOGLE.COM.CN
Registrar: XIN NET TECHNOLOGY CORPORATION
Whois Server: whois.paycenter.com.cn
Referral URL: http://www.xinnet.com
Server Name: GOOGLE.COM.CO
Registrar: NAMESECURE.COM
Whois Server: whois.namesecure.com
Referral URL: http://www.namesecure.com
Server Name: GOOGLE.COM.DEADKNIFERECORDS.COM
IP Address: 216.58.208.132
IP Address: 172.217.21.206
IP Address: 2A00:1450:4001:818:0:0:0:200E
IP Address: 2A00:1450:4009:803:0:0:0:2004
Registrar: GOOGLE INC.
Whois Server: whois.google.com
Referral URL: http://domains.google.com
Server Name: GOOGLE.COM.DGJTEST028-PP-QM-STG.COM
IP Address: 8.8.8.8
Registrar: JAPAN REGISTRY SERVICES CO., LTD.
Whois Server: whois2016.jprs.jp
Referral URL: http://jprs.jp/registrar/
Server Name: GOOGLE.COM.DO
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: http://www.godaddy.com
Server Name: GOOGLE.COM.EG
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: http://www.godaddy.com
Server Name: GOOGLE.COM.FORSALE
Registrar: NAMESILO, LLC
Whois Server: whois.namesilo.com
Referral URL: http://www.namesilo.com
Server Name: GOOGLE.COM.HACKED.BY.JAPTRON.ES
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: http://www.godaddy.com
Server Name: GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGINE.THAN.SECZY.COM
IP Address: 209.187.114.130
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.HK
Registrar: UK-2 LIMITED
Whois Server: whois.hostingservicesinc.net
Referral URL: http://www.uk2group.com/
Server Name: GOOGLE.COM.HOUDA.DO.YOU.WANT.TO.MARRY.ME.JEN.RE
Registrar: OVH
Whois Server: whois.ovh.com
Referral URL: http://www.ovh.com
Server Name: GOOGLE.COM.IS.APPROVED.BY.NUMEA.COM
IP Address: 213.228.0.43
Registrar: GANDI SAS
Whois Server: whois.gandi.net
Referral URL: http://www.gandi.net
Server Name: GOOGLE.COM.IS.NOT.HOSTED.BY.ACTIVEDOMAINDNS.NET
IP Address: 217.148.161.5
Registrar: HOSTING CONCEPTS B.V. D/B/A OPENPROVIDER
Whois Server: whois.registrar.eu
Referral URL: http://www.openprovider.com
Server Name: GOOGLE.COM.LASERPIPE.COM.DOMAINPENDINGDELETE.COM
IP Address: 209.85.227.106
Registrar: REALTIME REGISTER BV
Whois Server: whois.yoursrs.com
Referral URL: http://www.realtimeregister.com
Server Name: GOOGLE.COM.LOLOLOLOLOL.SHTHEAD.COM
IP Address: 123.123.123.123
Registrar: CRAZY DOMAINS FZ-LLC
Whois Server: whois.crazydomains.com
Referral URL: http://www.crazydomains.com
Server Name: GOOGLE.COM.MAIKO.BE
Registrar: OVH
Whois Server: whois.ovh.com
Referral URL: http://www.ovh.com
Server Name: GOOGLE.COM.MX
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.publicdomainregistry.com
Server Name: GOOGLE.COM.MY
Registrar: WILD WEST DOMAINS, LLC
Whois Server: whois.wildwestdomains.com
Referral URL: http://www.wildwestdomains.com
Server Name: GOOGLE.COM.NS1.CHALESHGAR.COM
IP Address: 8.8.8.8
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.NS2.CHALESHGAR.COM
IP Address: 8.8.8.8
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.PE
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.publicdomainregistry.com
Server Name: GOOGLE.COM.PK
Registrar: BIGROCK SOLUTIONS LIMITED
Whois Server: Whois.bigrock.com
Referral URL: http://www.bigrock.com
Server Name: GOOGLE.COM.SA
Registrar: OMNIS NETWORK, LLC
Whois Server: whois.omnis.com
Referral URL: http://www.omnis.com
Server Name: GOOGLE.COM.SG
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: http://www.godaddy.com
Server Name: GOOGLE.COM.SHQIPERIA.COM
IP Address: 70.84.145.107
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Server Name: GOOGLE.COM.SOUTHBEACHNEEDLEARTISTRY.COM
IP Address: 74.125.229.52
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: http://www.godaddy.com
Server Name: GOOGLE.COM.SPAMMING.IS.UNETHICAL.PLEASE.STOP.THEM.HUAXUEERBAN.COM
IP Address: 211.64.175.67
IP Address: 211.64.175.66
Registrar: GOOGLE INC.
Whois Server: whois.google.com
Referral URL: http://domains.google.com
Server Name: GOOGLE.COM.SPROSIUYANDEKSA.RU
Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Whois Server: whois.melbourneit.com
Referral URL: http://www.melbourneit.com.au
Server Name: GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.COM
IP Address: 80.190.192.24
Registrar: COREHUB, S.R.L.
Whois Server: whois.corehub.net
Referral URL: http://corehub.net
Server Name: GOOGLE.COM.TESTZZZZ.3000-RI.COM.DELETE-DNS.COM
IP Address: 8.8.8.8
Registrar: MEGAZONE CORP. DBA HOSTING.KR
Whois Server: whois.hosting.kr
Referral URL: http://HOSTING.KR
Server Name: GOOGLE.COM.TR
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.publicdomainregistry.com
Server Name: GOOGLE.COM.TW
Registrar: WEB COMMERCE COMMUNICATIONS LIMITED DBA WEBNIC.CC
Whois Server: whois.webnic.cc
Referral URL: http://www.webnic.cc
Server Name: GOOGLE.COM.UA
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.publicdomainregistry.com
Server Name: GOOGLE.COM.UK
Registrar: 123-REG LIMITED
Whois Server: whois.123-reg.co.uk
Referral URL: http://www.meshdigital.com
Server Name: GOOGLE.COM.UY
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.publicdomainregistry.com
Server Name: GOOGLE.COM.VABDAYOFF.COM
IP Address: 8.8.8.8
Registrar: DOMAIN.COM, LLC
Whois Server: whois.domain.com
Referral URL: http://www.domain.com
Server Name: GOOGLE.COM.VN
Registrar: ONLINENIC, INC.
Whois Server: whois.onlinenic.com
Referral URL: http://www.onlinenic.com
Server Name: GOOGLE.COM.YUCEHOCA.COM
IP Address: 88.246.115.134
Registrar: PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server: whois.PublicDomainRegistry.com
Referral URL: http://www.publicdomainregistry.com
Server Name: GOOGLE.COM.ZNAET.PRODOMEN.COM
IP Address: 62.149.23.126
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: http://www.godaddy.com
Domain Name: GOOGLE.COM
Registrar: MARKMONITOR INC.
Sponsoring Registrar IANA ID: 292
Whois Server: whois.markmonitor.com
Referral URL: http://www.markmonitor.com
Name Server: NS1.GOOGLE.COM
Name Server: NS2.GOOGLE.COM
Name Server: NS3.GOOGLE.COM
Name Server: NS4.GOOGLE.COM
Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
Updated Date: 20-jul-2011
Creation Date: 15-sep-1997
Expiration Date: 14-sep-2020
>>> Last update of whois database: 2017-07-23T02:12:11Z <<<
...

検索クエリを絞り込まないでwhosiコマンドを実施しすることで意図しないホストが得られるのはwhois spam(dns spam) というらしい。

ということで、自前のツールもここに対応してspam結果を拾わないようにした。

参考にしたページ

インターネット10分講座:WHOIS

Comments