North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Real-time WHOIS for .COM

  • From: william(at)elan.net
  • Date: Wed Aug 10 12:26:00 2005


I think the implied querstion may have been how to find registrar for
newly registered domains (<24 hours). In that case you're out of luck - there seems to be no way to do that - and yes, I've asked this
particular question from somebody @verisign before and he said they will
consider how this info can be made available (but nothing has been done
so far and there was no promise to do it - so keep asking them maybe if
they hear enough requests they will move on it). On somewhat similar
problem, I've also asked them to provide public access to deltas of nameserver changes (i.e. what changes to nameservers had been done for
domain within say last 24 hours)and nothing so far either (this is also very helpful when investigating phishes).

On Wed, 10 Aug 2005, william(at)elan.net wrote:

On Wed, 10 Aug 2005, Florian Weimer wrote:


Is there some kind of real-time WHOIS for .COM (and friends) which
allows you to determine at least the corresponding registrar?  This is
helpful if you have to pull a delegation in order to mitigate a
particular threat.
You can ask Verisign (NOT networksolutions) directly, but as far as I know they do updates of whois once/day and it is not real time and no other options are available. Note that registrar information should be current
in internic whois because registrar data can not be changed in real-time
and transfers are done once or twice a day (as far as I know, this may
have changed now too).

Best you can get is to do query using whois.completewhois.com since by
default our server will do both whois query to internic and dns query to
find current deligated dns servers. If they are different you will see this info after nameserver saying "[from dns" where as whois nameserver will be indicated with "[from whois". This can be helpful with some
domains that change nameservers often (domains used in phsh emails in particular seem to be used this way).


--
William Leibzon
Elan Networks
[email protected]