2012-06-12 16:36:44 +0100, Martin Gregorie: > Today I got a piece of spam carrying the URL chasovik.it.gg as its > payload. I was intrigued because I didn't think .gg was a valid tld and > looked it up with 'whois'. Sure enough, no match was found. However, > 'host' resolved it as 80.190.202.40 and a 'host' lookup on the IP > resolved to homepage-baukasten.de, which is known to 'whois'. [...]
You're not querying the right whois server Try whois -h whois.gg it.gg -- Stephane
