Microsoft WHOIS hacked?

Surprising results using one particular network utility, whois server

[oodlum]

When I do a WHOIS lookup of microsoft.com, msn.com, hotmail.com using a web-based search (including internic) I get the results you'd expect, but when I tried the OS X Network Utility Whois tool (using the server whois.internic.net) here's what I found (expletives deleted):

MICROSOFT.COM.ZZZ.IS.0WNED.AND.HAX0RED.BY.SUB7.NET
MICROSOFT.COM.IS.GOD.BECOUSE.UNIXSUCKS.COM
<Snip>And a dozen more examples</Snip>

Cute, huh? I'm guessing that the whois.internic.net server has been hacked?

Why the disparity between this and the regular internic lookup?

[edited by: Webwork at 12:55 pm (utc) on July 28, 2006]
[edit reason]
[1][edit reason] Tidying up [/edit] [/edit][/1]

[jtara]

I can confirm this. I just did a lookup using a Windows-based product that allows you to query a specific WHOIS server.

Note that these are just "comments" and aren't doing any harm. Perhaps that's why they've (apparently) gone unnoticed for a while?

whois.internic.net will never give you actual WHOIS information, in any case. It just gives you a referral to the WHOIS server that has the actual data. Most WHOIS tools first look at whois.internic.net, and then look at the WHOIS server indicated there.

If, indeed, whois.internic.net has been compromised, that is major news. If somebody inserted comments into Microsoft's record, they probably could have changed the pointer to the authorative WHOIS server.

[wmuser]

I cant reproduce it,how did you get such a results?

[encyclo]

This has been known about for years. microsoft.com has not been hacked, if you look at the examples you gave, they are subdomains - registered nameservers which include the string "microsoft.com" in the name.

See this explanation from 2003:

[lists.grok.org.uk...]

Same thing happens for google.com and quite a few other domains.

[oodlum]

Ahhh... got it. Thanks.