Whois Source

[primacomputer]

I've come across something really interesting. While running a text search on archived whois data I got some strange results. It turns out occasionally the server returns the source code of the whois script instead of the desired results. I assume this happens sometimes when they're doing maintenance. I just have so many machines doing so many queries that I inevitably manage to do a query during that time.

There is some really interesting stuff in here. Host names, file locations, database connection strings, etc. Has anyone else run into this before? I'd be interested in swapping notes.

 

[ThreeD]

Why is this posted under Domain Name Discussions?

you run this search over at archive.org?

 

[mappaiyo]

I think it's only because your request is not completed because there is an internal error from the web server, and the result is sometimes the source code of the page that we requested.

Regards

 

[primacomputer]

I wasn't quite sure where to post this. There isn't exactly a “report glitches in registrars whois servers” forum

The data comes from my own archives. All whois queries done from any of my sites, servers, or workstations in any of the offices are archived. I use this data for research, kinda like a mini whois.sc with enhanced search capabilities such as a free text search. I found this when I searched for a keyword that one registrar happened to use in their code.

It's definitely problems with web server configurations that are causing this. But what is really interesting is that with access to the code you can see how the registrar itself looks up the data. Quite often they query a unpublished rwhois server. In theory one could query that directly, bypassing the restrictions implemented in the script. It's also interesting to see what these restrictions are and how they work.

I'm just curious if anyone else has ever run across this, and if so whether they made use of any of this information.