On Tue, 2012-06-12 at 18:47 +0100, Stephane Chazelas wrote: > 2012-06-12 16:36:44 +0100, Martin Gregorie: > > Today I got a piece of spam carrying the URL chasovik.it.gg as its > > payload. I was intrigued because I didn't think .gg was a valid tld and > > looked it up with 'whois'. Sure enough, no match was found. However, > > 'host' resolved it as 80.190.202.40 and a 'host' lookup on the IP > > resolved to homepage-baukasten.de, which is known to 'whois'. > [...] > > You're not querying the right whois server > > Try > > whois -h whois.gg it.gg > OK, and I see from the TLD list that .gg is another tart's TLD: unlike many national TLDs, the registrants don't need any connection to Gurnsey to own a URL under it, so its probably worth treating .gg the same way as .cn and .ru, though for slightly different reasons.
Martin
