Macos – How to use command line whois for “spam infected” domains like apple.com

That's not too hard.

Check the list of domains domains.txt, and add the domain to available.txt once it's found (by looking at the return value of grep, which is stored in $?).

Then, remove the found domains from domains.txt with sed in-place editing.

#!/bin/bash

AVAILABLE=~/available.txt
DOMAINS=~/domains.txt

lockfile whois-script.lock

while read -r domain; do
  whois $domain | grep -qci "No match"
  if [ $? -ne 0 ]; then
    # found
    echo $domain >> $AVAILABLE
  fi
done < $DOMAINS

while read -r domain; do
  sed -i "/$domain/d" $DOMAINS
done < $AVAILABLE

rm -f whois-script.lock

Note: On BSD sed, you want to use the following command:

sed -i "" "/$domain/d" $DOMAINS

You can save this script and call it from your crontab. Enter

crontab -e

and then add a line like this:

*/2 *   *   *   *   /path/to/script.sh > /dev/null

This will run the script every two minutes (*/2). Make sure to adjust the paths to the domain before.

The whois command on your Mac is perfectly fine.

You're simply querying a different NICNAME server with each tool. The BSD whois tool in MacOS 10 uses the whois-servers.net. mechanism, and in this case is querying the com.whois-servers.net. NICNAME server, run by Verisign Incorporated. Other people's computers are using a different whois command that probably hardwires whois.networksolutions.com., run by Network Solutions LLC, as the NICNAME server.

What you see is what the different NICNAME servers are actually publishing. This is nothing to do with your client tool at all. People have actually registered all of those. Note what the MacOS manual says about the Network Solutions NICNAME server. You're querying the registry's NICNAME server, and seeing a whole load of registrations made through several different registrars, from MarkMonitor to Tucows. The other people are querying one registrar's NICNAME server, and seeing only the registrations made through that specific registrar.

Run

whois '=google.com'

with the BSD whois tool and you'll receive extended output from the registry's NICNAME server showing where each registrar's individual NICNAME server is. (The output in your question tells you this very trick.) Again, this is a server-side function, and not all NICNAME servers work the same way — as you can see if you try the same trick with the Network Solutions LLC NICNAME server.

One of the reasons that whois commands vary is that the days of there being one place, or even a few places, to go for NICNAME service are long past. You're using one of the more modern whois tools that uses one of two available DNS mechanisms to automatically locate the NICNAME server to use for any given domain name. Other, clunkier and higher-maintenance, whois tools have hardwired NICNAME server names, or configuration files that need regular servicing.

Further reading

• Jonathan de Boyne Pollard (2010). whois. Internet Utilities for OS/2 user guide.
• whois. 2004-06-14. MacOS 10 Manual Pages. Apple corporation.
• Marco d'Itri. whois. Ubuntu manual pages. Canonical.
• "Site Configuration". GNU jwhois manual. Free Software Foundation.
• Jonathan de Boyne Pollard (2009). "NICNAME clients that use SRV lookups". Some application clients use SRV lookups, a few (to their embarrassment) do not.. Frequently Given Answers.
• Jonathan de Boyne Pollard (2009). Providing your own NICNAME service.. Frequently Given Answers.